API tools faq
paste
Guest User

Untitled

a guest
Feb 21st, 2018
49
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 129.97 KB | None | 0 0
raw download clone embed print report
  1. 002e:trace:relay:load_list L"RelayExclude" = L"ntdll.RtlEnterCriticalSection;ntdll.RtlLeaveCriticalSection;kernel32.48;kernel32.49;kernel32.94;kernel32.95;kernel32.96;kernel32.97;kernel32.98;kernel32.TlsGetValue;kernel32.TlsSetValue;kernel32.FlsGetValue;kernel32.FlsSetValue;kernel32.SetLastError"
  2. 002e:trace:relay:load_list L"RelayFromExclude" = L"winex11.drv;user32;gdi32;advapi32;kernel32"
  3. 002e:Call KERNEL32.__wine_kernel_init() ret=7bc41db9
  4. 002e:Call PE DLL (proc=0x7bc7b8c0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1)
  5. 002e:Ret PE DLL (proc=0x7bc7b8c0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
  6. 002e:Call PE DLL (proc=0x7b8725f0,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1)
  7. 002e:Ret PE DLL (proc=0x7b8725f0,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
  8. 002e:Call PE DLL (proc=0x406ad5a0,module=0x40690000 L"ws2_32.dll",reason=PROCESS_ATTACH,res=0x1)
  9. 002e:Ret PE DLL (proc=0x406ad5a0,module=0x40690000 L"ws2_32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
  10. 002e:Call PE DLL (proc=0x40702970,module=0x406c0000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1)
  11. 002e:Ret PE DLL (proc=0x40702970,module=0x406c0000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
  12. 002e:Call PE DLL (proc=0x401e72d0,module=0x401d0000 L"iphlpapi.dll",reason=PROCESS_ATTACH,res=0x1)
  13. 002e:Call KERNEL32.DisableThreadLibraryCalls(401d0000) ret=401e2cb1
  14. 002e:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=401e2cb1
  15. 002e:Ret PE DLL (proc=0x401e72d0,module=0x401d0000 L"iphlpapi.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
  16. 002e:Call PE DLL (proc=0x401c52a0,module=0x401c0000 L"wsock32.dll",reason=PROCESS_ATTACH,res=0x1)
  17. 002e:Call KERNEL32.DisableThreadLibraryCalls(401c0000) ret=401c5348
  18. 002e:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=401c5348
  19. 002e:Ret PE DLL (proc=0x401c52a0,module=0x401c0000 L"wsock32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
  20. 002e:Call PE DLL (proc=0x407aaee0,module=0x40730000 L"gdi32.dll",reason=PROCESS_ATTACH,res=0x1)
  21. 002e:Ret PE DLL (proc=0x407aaee0,module=0x40730000 L"gdi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
  22. 002e:Call PE DLL (proc=0x411667a0,module=0x41160000 L"version.dll",reason=PROCESS_ATTACH,res=0x1)
  23. 002e:Call KERNEL32.DisableThreadLibraryCalls(41160000) ret=41166848
  24. 002e:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=41166848
  25. 002e:Ret PE DLL (proc=0x411667a0,module=0x41160000 L"version.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
  26. 002e:Call PE DLL (proc=0x410ac360,module=0x41010000 L"user32.dll",reason=PROCESS_ATTACH,res=0x1)
  27. 002e:Call PE DLL (proc=0x41d75be0,module=0x41d60000 L"imm32.dll",reason=PROCESS_ATTACH,res=0x0)
  28. 002e:Call user32.RegisterWindowMessageA(41d7636c "MSIMEService") ret=41d70ade
  29. 002e:Ret user32.RegisterWindowMessageA() retval=0000c000 ret=41d70ade
  30. 002e:Call user32.RegisterWindowMessageA(41d76379 "MSIMEReconvertOptions") ret=41d70af5
  31. 002e:Ret user32.RegisterWindowMessageA() retval=0000c001 ret=41d70af5
  32. 002e:Call user32.RegisterWindowMessageA(41d7638f "MSIMEMouseOperation") ret=41d70b0c
  33. 002e:Ret user32.RegisterWindowMessageA() retval=0000c002 ret=41d70b0c
  34. 002e:Call user32.RegisterWindowMessageA(41d763a3 "MSIMEReconvertRequest") ret=41d70b23
  35. 002e:Ret user32.RegisterWindowMessageA() retval=0000c003 ret=41d70b23
  36. 002e:Call user32.RegisterWindowMessageA(41d763b9 "MSIMEReconvert") ret=41d70b3a
  37. 002e:Ret user32.RegisterWindowMessageA() retval=0000c004 ret=41d70b3a
  38. 002e:Call user32.RegisterWindowMessageA(41d763c8 "MSIMEQueryPosition") ret=41d70b51
  39. 002e:Ret user32.RegisterWindowMessageA() retval=0000c005 ret=41d70b51
  40. 002e:Call user32.RegisterWindowMessageA(41d763db "MSIMEDocumentFeed") ret=41d70b68
  41. 002e:Ret user32.RegisterWindowMessageA() retval=0000c006 ret=41d70b68
  42. 002e:Call KERNEL32.TlsAlloc() ret=41d70b76
  43. 002e:Ret KERNEL32.TlsAlloc() retval=00000000 ret=41d70b76
  44. 002e:Ret PE DLL (proc=0x41d75be0,module=0x41d60000 L"imm32.dll",reason=PROCESS_ATTACH,res=0x0) retval=1
  45. 002e:Call PE DLL (proc=0x41bfded0,module=0x41b90000 L"winex11.drv",reason=PROCESS_ATTACH,res=0x0)
  46. 002e:Ret PE DLL (proc=0x41bfded0,module=0x41b90000 L"winex11.drv",reason=PROCESS_ATTACH,res=0x0) retval=1
  47. 002e:Ret PE DLL (proc=0x410ac360,module=0x41010000 L"user32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
  48. 002e:Call PE DLL (proc=0x4118a170,module=0x41170000 L"netapi32.dll",reason=PROCESS_ATTACH,res=0x1)
  49. 002e:Call KERNEL32.DisableThreadLibraryCalls(41170000) ret=4118634b
  50. 002e:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=4118634b
  51. 002e:Call KERNEL32.InitializeCriticalSection(41190b40) ret=41186f2c
  52. 002e:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=41186f2c
  53. 002e:Call advapi32.RegOpenKeyExW(80000002,4118d340 L"SYSTEM\\CurrentControlSet\\Services\\VxD\\MSTCP",00000000,00020019,0033fce8) ret=41183153
  54. 002e:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=41183153
  55. 002e:Call advapi32.RegQueryValueExW(00000034,4118d406 L"EnableDNS",00000000,00000000,0033fce4,0033fce0) ret=41183290
  56. 002e:Ret advapi32.RegQueryValueExW() retval=00000002 ret=41183290
  57. 002e:Call advapi32.RegQueryValueExW(00000034,4118d420 L"BcastNameQueryCount",00000000,00000000,0033fce4,0033fce0) ret=411832da
  58. 002e:Ret advapi32.RegQueryValueExW() retval=00000002 ret=411832da
  59. 002e:Call advapi32.RegQueryValueExW(00000034,4118d460 L"BcastNameQueryTimeout",00000000,00000000,0033fce4,0033fce0) ret=4118333a
  60. 002e:Ret advapi32.RegQueryValueExW() retval=00000002 ret=4118333a
  61. 002e:Call advapi32.RegQueryValueExW(00000034,4118d4a0 L"NameSrvQueryCount",00000000,00000000,0033fce4,0033fce0) ret=4118338e
  62. 002e:Ret advapi32.RegQueryValueExW() retval=00000002 ret=4118338e
  63. 002e:Call advapi32.RegQueryValueExW(00000034,4118d4e0 L"NameSrvQueryTimeout",00000000,00000000,0033fce4,0033fce0) ret=411833ea
  64. 002e:Ret advapi32.RegQueryValueExW() retval=00000002 ret=411833ea
  65. 002e:Call advapi32.RegQueryValueExW(00000034,4118d508 L"ScopeID",00000000,00000000,411909c1,0033fce0) ret=41183444
  66. 002e:Ret advapi32.RegQueryValueExW() retval=00000002 ret=41183444
  67. 002e:Call advapi32.RegQueryValueExW(00000034,4118d518 L"CacheTimeout",00000000,00000000,0033fce4,0033fce0) ret=411834b3
  68. 002e:Ret advapi32.RegQueryValueExW() retval=00000002 ret=411834b3
  69. 002e:Call advapi32.RegCloseKey(00000034) ret=411834da
  70. 002e:Ret advapi32.RegCloseKey() retval=00000000 ret=411834da
  71. 002e:Call advapi32.RegOpenKeyW(80000001,4118d540 L"Software\\Wine\\Network",0033fce8) ret=411831bd
  72. 002e:Ret advapi32.RegOpenKeyW() retval=00000002 ret=411831bd
  73. 002e:Ret PE DLL (proc=0x4118a170,module=0x41170000 L"netapi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
  74. 002e:Call PE DLL (proc=0x41248a50,module=0x411a0000 L"comctl32.dll",reason=PROCESS_ATTACH,res=0x1)
  75. 002e:Call KERNEL32.DisableThreadLibraryCalls(411a0000) ret=411bc86b
  76. 002e:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=411bc86b
  77. 002e:Call KERNEL32.GlobalAddAtomW(41256360 L"CC32SubclassInfo") ret=411bc882
  78. 002e:Ret KERNEL32.GlobalAddAtomW() retval=0000c016 ret=411bc882
  79. 002e:Call gdi32.CreateBitmap(00000008,00000008,00000001,00000001,41256382) ret=411bc8c9
  80. 002e:Ret gdi32.CreateBitmap() retval=000001d4 ret=411bc8c9
  81. 002e:Call gdi32.CreatePatternBrush(000001d4) ret=411bc8da
  82. 002e:Ret gdi32.CreatePatternBrush() retval=000001dc ret=411bc8da
  83. 002e:Call user32.GetSysColor(00000014) ret=411ba7ca
  84. 002e:Ret user32.GetSysColor() retval=00ffffff ret=411ba7ca
  85. 002e:Call user32.GetSysColor(00000010) ret=411ba7e1
  86. 002e:Ret user32.GetSysColor() retval=00808080 ret=411ba7e1
  87. 002e:Call user32.GetSysColor(00000012) ret=411ba7f3
  88. 002e:Ret user32.GetSysColor() retval=00000000 ret=411ba7f3
  89. 002e:Call user32.GetSysColor(0000000f) ret=411ba805
  90. 002e:Ret user32.GetSysColor() retval=00c8d0d4 ret=411ba805
  91. 002e:Call user32.GetSysColor(0000000d) ret=411ba817
  92. 002e:Ret user32.GetSysColor() retval=006a240a ret=411ba817
  93. 002e:Call user32.GetSysColor(0000000e) ret=411ba829
  94. 002e:Ret user32.GetSysColor() retval=00ffffff ret=411ba829
  95. 002e:Call user32.GetSysColor(0000001a) ret=411ba83b
  96. 002e:Ret user32.GetSysColor() retval=00c80000 ret=411ba83b
  97. 002e:Call user32.GetSysColor(00000014) ret=411ba84d
  98. 002e:Ret user32.GetSysColor() retval=00ffffff ret=411ba84d
  99. 002e:Call user32.GetSysColor(00000010) ret=411ba85f
  100. 002e:Ret user32.GetSysColor() retval=00808080 ret=411ba85f
  101. 002e:Call user32.GetSysColor(00000015) ret=411ba871
  102. 002e:Ret user32.GetSysColor() retval=00404040 ret=411ba871
  103. 002e:Call user32.GetSysColor(0000000f) ret=411ba883
  104. 002e:Ret user32.GetSysColor() retval=00c8d0d4 ret=411ba883
  105. 002e:Call user32.GetSysColor(00000005) ret=411ba895
  106. 002e:Ret user32.GetSysColor() retval=00ffffff ret=411ba895
  107. 002e:Call user32.GetSysColor(00000008) ret=411ba8a7
  108. 002e:Ret user32.GetSysColor() retval=00000000 ret=411ba8a7
  109. 002e:Call user32.GetSysColor(00000011) ret=411ba8b9
  110. 002e:Ret user32.GetSysColor() retval=00808080 ret=411ba8b9
  111. 002e:Call user32.GetSysColor(00000002) ret=411ba8cb
  112. 002e:Ret user32.GetSysColor() retval=006a240a ret=411ba8cb
  113. 002e:Call user32.GetSysColor(00000018) ret=411ba8dd
  114. 002e:Ret user32.GetSysColor() retval=00e1ffff ret=411ba8dd
  115. 002e:Call user32.GetSysColor(00000017) ret=411ba8ef
  116. 002e:Ret user32.GetSysColor() retval=00000000 ret=411ba8ef
  117. 002e:Call user32.LoadCursorW(00000000,00007f00) ret=411af136
  118. 002e:Ret user32.LoadCursorW() retval=000a00a4 ret=411af136
  119. 002e:Call user32.RegisterClassW(0033fcac) ret=411af19f
  120. 002e:Ret user32.RegisterClassW() retval=0000c017 ret=411af19f
  121. 002e:Call user32.LoadCursorW(00000000,00007f00) ret=411b1d56
  122. 002e:Ret user32.LoadCursorW() retval=000a00a4 ret=411b1d56
  123. 002e:Call user32.RegisterClassW(0033fcac) ret=411b1dbf
  124. 002e:Ret user32.RegisterClassW() retval=0000c018 ret=411b1dbf
  125. 002e:Call user32.LoadCursorW(00000000,00007f00) ret=411bccb6
  126. 002e:Ret user32.LoadCursorW() retval=000a00a4 ret=411bccb6
  127. 002e:Call user32.RegisterClassW(0033fca4) ret=411bcd3d
  128. 002e:Ret user32.RegisterClassW() retval=0000c019 ret=411bcd3d
  129. 002e:Call user32.LoadCursorW(00000000,00007f00) ret=411c3ff6
  130. 002e:Ret user32.LoadCursorW() retval=000a00a4 ret=411c3ff6
  131. 002e:Call user32.RegisterClassW(0033fca8) ret=411c406b
  132. 002e:Ret user32.RegisterClassW() retval=0000c01a ret=411c406b
  133. 002e:Call user32.LoadCursorW(00000000,00007f00) ret=411c47d6
  134. 002e:Ret user32.LoadCursorW() retval=000a00a4 ret=411c47d6
  135. 002e:Call user32.RegisterClassW(0033fcb0) ret=411c4832
  136. 002e:Ret user32.RegisterClassW() retval=0000c01b ret=411c4832
  137. 002e:Call user32.RegisterClassW(0033fcb8) ret=411c91d7
  138. 002e:Ret user32.RegisterClassW() retval=0000c01c ret=411c91d7
  139. 002e:Call user32.LoadCursorW(00000000,00007f01) ret=411d2ca6
  140. 002e:Ret user32.LoadCursorW() retval=0015009e ret=411d2ca6
  141. 002e:Call user32.RegisterClassW(0033fca8) ret=411d2d1b
  142. 002e:Ret user32.RegisterClassW() retval=0000c01d ret=411d2d1b
  143. 002e:Call user32.LoadCursorW(00000000,00007f00) ret=411d4896
  144. 002e:Ret user32.LoadCursorW() retval=000a00a4 ret=411d4896
  145. 002e:Call user32.RegisterClassW(0033fcac) ret=411d4905
  146. 002e:Ret user32.RegisterClassW() retval=0000c01e ret=411d4905
  147. 002e:Call user32.LoadCursorW(00000000,00007f00) ret=411f0956
  148. 002e:Ret user32.LoadCursorW() retval=000a00a4 ret=411f0956
  149. 002e:Call user32.RegisterClassW(0033fcac) ret=411f09c5
  150. 002e:Ret user32.RegisterClassW() retval=0000c01f ret=411f09c5
  151. 002e:Call user32.LoadCursorW(00000000,00007f00) ret=411f92a6
  152. 002e:Ret user32.LoadCursorW() retval=000a00a4 ret=411f92a6
  153. 002e:Call user32.RegisterClassW(0033fcac) ret=411f9315
  154. 002e:Ret user32.RegisterClassW() retval=0000c020 ret=411f9315
  155. 002e:Call user32.LoadCursorW(00000000,00007f00) ret=411f9626
  156. 002e:Ret user32.LoadCursorW() retval=000a00a4 ret=411f9626
  157. 002e:Call user32.RegisterClassW(0033fcb4) ret=411f9677
  158. 002e:Ret user32.RegisterClassW() retval=0000c021 ret=411f9677
  159. 002e:Call user32.LoadCursorW(00000000,00007f00) ret=411fc6d6
  160. 002e:Ret user32.LoadCursorW() retval=000a00a4 ret=411fc6d6
  161. 002e:Call user32.RegisterClassW(0033fca4) ret=411fc756
  162. 002e:Ret user32.RegisterClassW() retval=0000c022 ret=411fc756
  163. 002e:Call user32.RegisterClassW(0033fcbc) ret=41205d9b
  164. 002e:Ret user32.RegisterClassW() retval=0000c023 ret=41205d9b
  165. 002e:Call user32.GetSystemMetrics(00000044) ret=41205daa
  166. 002e:Ret user32.GetSystemMetrics() retval=00000004 ret=41205daa
  167. 002e:Call user32.GetSystemMetrics(00000045) ret=41205dbf
  168. 002e:Ret user32.GetSystemMetrics() retval=00000004 ret=41205dbf
  169. 002e:Call user32.LoadCursorW(00000000,00007f00) ret=4120f420
  170. 002e:Ret user32.LoadCursorW() retval=000a00a4 ret=4120f420
  171. 002e:Call user32.RegisterClassW(0033fca0) ret=4120f4ad
  172. 002e:Ret user32.RegisterClassW() retval=0000c024 ret=4120f4ad
  173. 002e:Call user32.LoadCursorW(00000000,00007f00) ret=41214916
  174. 002e:Ret user32.LoadCursorW() retval=000a00a4 ret=41214916
  175. 002e:Call user32.RegisterClassW(0033fcb8) ret=4121495a
  176. 002e:Ret user32.RegisterClassW() retval=0000c025 ret=4121495a
  177. 002e:Call user32.LoadCursorW(00000000,00007f00) ret=41217526
  178. 002e:Ret user32.LoadCursorW() retval=000a00a4 ret=41217526
  179. 002e:Call user32.RegisterClassW(0033fca8) ret=412175a1
  180. 002e:Ret user32.RegisterClassW() retval=0000c026 ret=412175a1
  181. 002e:Call user32.LoadCursorW(00000000,00007f00) ret=41221c26
  182. 002e:Ret user32.LoadCursorW() retval=000a00a4 ret=41221c26
  183. 002e:Call user32.RegisterClassW(0033fca8) ret=41221ca1
  184. 002e:Ret user32.RegisterClassW() retval=0000c027 ret=41221ca1
  185. 002e:Call user32.LoadCursorW(00000000,00007f00) ret=41231220
  186. 002e:Ret user32.LoadCursorW() retval=000a00a4 ret=41231220
  187. 002e:Call user32.RegisterClassW(0033fca4) ret=412312a1
  188. 002e:Ret user32.RegisterClassW() retval=0000c028 ret=412312a1
  189. 002e:Call user32.LoadImageW(411a0000,00000016,00000001,00000000,00000000,00000000) ret=412312ec
  190. 002e:Ret user32.LoadImageW() retval=00260082 ret=412312ec
  191. 002e:Call user32.LoadImageW(411a0000,00000019,00000001,00000000,00000000,00000000) ret=41231324
  192. 002e:Ret user32.LoadImageW() retval=000e0026 ret=41231324
  193. 002e:Call user32.LoadImageW(411a0000,0000001c,00000001,00000000,00000000,00000000) ret=4123135c
  194. 002e:Ret user32.LoadImageW() retval=000600ae ret=4123135c
  195. 002e:Call user32.LoadCursorW(00000000,00007f00) ret=41236326
  196. 002e:Ret user32.LoadCursorW() retval=000a00a4 ret=41236326
  197. 002e:Call user32.RegisterClassW(0033fca4) ret=412363ad
  198. 002e:Ret user32.RegisterClassW() retval=0000c029 ret=412363ad
  199. 002e:Call user32.LoadCursorW(00000000,00007f00) ret=4123a6d3
  200. 002e:Ret user32.LoadCursorW() retval=000a00a4 ret=4123a6d3
  201. 002e:Call user32.RegisterClassW(0033fcac) ret=4123a742
  202. 002e:Ret user32.RegisterClassW() retval=0000c02a ret=4123a742
  203. 002e:Call user32.LoadCursorW(00000000,00007f00) ret=412463e6
  204. 002e:Ret user32.LoadCursorW() retval=000a00a4 ret=412463e6
  205. 002e:Call user32.RegisterClassW(0033fca8) ret=41246461
  206. 002e:Ret user32.RegisterClassW() retval=0000c02b ret=41246461
  207. 002e:Call KERNEL32.LoadLibraryA(4125e152 "uxtheme.dll") ret=41248a0b
  208. 002e:Call PE DLL (proc=0x428cb5a0,module=0x428b0000 L"uxtheme.dll",reason=PROCESS_ATTACH,res=0x0)
  209. 002e:Call KERNEL32.DisableThreadLibraryCalls(428b0000) ret=428c395e
  210. 002e:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=428c395e
  211. 002e:Call KERNEL32.GlobalAddAtomW(428da12a L"ux_theme") ret=428c98a8
  212. 002e:Ret KERNEL32.GlobalAddAtomW() retval=0000c02c ret=428c98a8
  213. 002e:Call KERNEL32.GlobalAddAtomW(428da116 L"ux_subapp") ret=428c98c0
  214. 002e:Ret KERNEL32.GlobalAddAtomW() retval=0000c02d ret=428c98c0
  215. 002e:Call KERNEL32.GlobalAddAtomW(428da0fe L"ux_subidlst") ret=428c98d8
  216. 002e:Ret KERNEL32.GlobalAddAtomW() retval=0000c02e ret=428c98d8
  217. 002e:Call KERNEL32.GlobalAddAtomW(428da0e0 L"ux_dialogtheme") ret=428c98f0
  218. 002e:Ret KERNEL32.GlobalAddAtomW() retval=0000c02f ret=428c98f0
  219. 002e:Call advapi32.RegOpenKeyW(80000001,428d9f60 L"Software\\Microsoft\\Windows\\CurrentVersion\\ThemeManager",0033f588) ret=428c9919
  220. 002e:Ret advapi32.RegOpenKeyW() retval=00000002 ret=428c9919
  221. 002e:Ret PE DLL (proc=0x428cb5a0,module=0x428b0000 L"uxtheme.dll",reason=PROCESS_ATTACH,res=0x0) retval=1
  222. 002e:Ret KERNEL32.LoadLibraryA() retval=428b0000 ret=41248a0b
  223. 002e:Call KERNEL32.GetProcAddress(428b0000,4125e27e "IsThemeActive") ret=412489dc
  224. 002e:Ret KERNEL32.GetProcAddress() retval=428bba94 ret=412489dc
  225. 002e:Call uxtheme.IsThemeActive() ret=412217c7
  226. 002e:Ret uxtheme.IsThemeActive() retval=00000000 ret=412217c7
  227. 002e:Ret PE DLL (proc=0x41248a50,module=0x411a0000 L"comctl32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
  228. 002e:Call PE DLL (proc=0x41659e40,module=0x41620000 L"shlwapi.dll",reason=PROCESS_ATTACH,res=0x1)
  229. 002e:Call KERNEL32.DisableThreadLibraryCalls(41620000) ret=4164b2bb
  230. 002e:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=4164b2bb
  231. 002e:Call KERNEL32.TlsAlloc() ret=4164b2c9
  232. 002e:Ret KERNEL32.TlsAlloc() retval=00000002 ret=4164b2c9
  233. 002e:Ret PE DLL (proc=0x41659e40,module=0x41620000 L"shlwapi.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
  234. 002e:Call PE DLL (proc=0x4145b3c0,module=0x413d0000 L"shell32.dll",reason=PROCESS_ATTACH,res=0x1)
  235. 002e:Call KERNEL32.DisableThreadLibraryCalls(413d0000) ret=41405b61
  236. 002e:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=41405b61
  237. 002e:Call KERNEL32.GetModuleFileNameW(413d0000,415d5a80,00000104) ret=41405b7e
  238. 002e:Ret KERNEL32.GetModuleFileNameW() retval=0000001f ret=41405b7e
  239. 002e:Call comctl32.InitCommonControlsEx(00000000) ret=41405b96
  240. 002e:Ret comctl32.InitCommonControlsEx() retval=00000000 ret=41405b96
  241. 002e:Call user32.GetSystemMetrics(00000031) ret=413fb8d1
  242. 002e:Ret user32.GetSystemMetrics() retval=00000010 ret=413fb8d1
  243. 002e:Call user32.GetSystemMetrics(00000032) ret=413fb8e2
  244. 002e:Ret user32.GetSystemMetrics() retval=00000010 ret=413fb8e2
  245. 002e:Call user32.GetSystemMetrics(0000000b) ret=413fb8f3
  246. 002e:Ret user32.GetSystemMetrics() retval=00000020 ret=413fb8f3
  247. 002e:Call user32.GetSystemMetrics(0000000c) ret=413fb905
  248. 002e:Ret user32.GetSystemMetrics() retval=00000020 ret=413fb905
  249. 002e:Call comctl32.DPA_Create(00000010) ret=413fb98c
  250. 002e:Call KERNEL32.LocalAlloc(00000040,00000014) ret=411b86d3
  251. 002e:Ret KERNEL32.LocalAlloc() retval=00158a18 ret=411b86d3
  252. 002e:Ret comctl32.DPA_Create() retval=00158a18 ret=413fb98c
  253. 002e:Call comctl32.ImageList_Create(00000010,00000010,00000021,00000000,00000020) ret=413fb9c1
  254. 002e:Call gdi32.CreateCompatibleDC(00000000) ret=411d04b0
  255. 002e:Ret gdi32.CreateCompatibleDC() retval=00000250 ret=411d04b0
  256. 002e:Call gdi32.CreateCompatibleDC(00000000) ret=411d06a8
  257. 002e:Ret gdi32.CreateCompatibleDC() retval=0000025c ret=411d06a8
  258. 002e:Call KERNEL32.LocalAlloc(00000040,00000028) ret=411b86d3
  259. 002e:Ret KERNEL32.LocalAlloc() retval=001592b8 ret=411b86d3
  260. 002e:Call gdi32.CreateDIBSection(00000250,001592b8,00000000,0033fafc,00000000,00000000) ret=411cb607
  261. 002e:Ret gdi32.CreateDIBSection() retval=00000268 ret=411cb607
  262. 002e:Call KERNEL32.LocalFree(001592b8) ret=411b841b
  263. 002e:Ret KERNEL32.LocalFree() retval=00000000 ret=411b841b
  264. 002e:Call gdi32.SelectObject(00000250,00000268) ret=411d0518
  265. 002e:Ret gdi32.SelectObject() retval=0000006c ret=411d0518
  266. 002e:Call gdi32.CreateBitmap(00000040,00000010,00000001,00000001,00000000) ret=411d0735
  267. 002e:Ret gdi32.CreateBitmap() retval=00000270 ret=411d0735
  268. 002e:Call gdi32.SelectObject(0000025c,00000270) ret=411d0754
  269. 002e:Ret gdi32.SelectObject() retval=0000006c ret=411d0754
  270. 002e:Call gdi32.CreateBitmap(00000008,00000008,00000001,00000001,4125647a) ret=411d057a
  271. 002e:Ret gdi32.CreateBitmap() retval=00000274 ret=411d057a
  272. 002e:Call gdi32.CreatePatternBrush(00000274) ret=411d058a
  273. 002e:Ret gdi32.CreatePatternBrush() retval=0000027c ret=411d058a
  274. 002e:Call gdi32.DeleteObject(00000274) ret=411d0598
  275. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411d0598
  276. 002e:Call gdi32.CreateBitmap(00000008,00000008,00000001,00000001,4125646a) ret=411d05c9
  277. 002e:Ret gdi32.CreateBitmap() retval=00000280 ret=411d05c9
  278. 002e:Call gdi32.CreatePatternBrush(00000280) ret=411d05d9
  279. 002e:Ret gdi32.CreatePatternBrush() retval=00000288 ret=411d05d9
  280. 002e:Call gdi32.DeleteObject(00000280) ret=411d05e7
  281. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411d05e7
  282. 002e:Ret comctl32.ImageList_Create() retval=00158c30 ret=413fb9c1
  283. 002e:Call comctl32.ImageList_Create(00000020,00000020,00000021,00000000,00000020) ret=413fb9f6
  284. 002e:Call gdi32.CreateCompatibleDC(00000000) ret=411d04b0
  285. 002e:Ret gdi32.CreateCompatibleDC() retval=0000028c ret=411d04b0
  286. 002e:Call gdi32.CreateCompatibleDC(00000000) ret=411d06a8
  287. 002e:Ret gdi32.CreateCompatibleDC() retval=00000298 ret=411d06a8
  288. 002e:Call KERNEL32.LocalAlloc(00000040,00000028) ret=411b86d3
  289. 002e:Ret KERNEL32.LocalAlloc() retval=0015afa0 ret=411b86d3
  290. 002e:Call gdi32.CreateDIBSection(0000028c,0015afa0,00000000,0033fafc,00000000,00000000) ret=411cb607
  291. 002e:Ret gdi32.CreateDIBSection() retval=000002a4 ret=411cb607
  292. 002e:Call KERNEL32.LocalFree(0015afa0) ret=411b841b
  293. 002e:Ret KERNEL32.LocalFree() retval=00000000 ret=411b841b
  294. 002e:Call gdi32.SelectObject(0000028c,000002a4) ret=411d0518
  295. 002e:Ret gdi32.SelectObject() retval=0000006c ret=411d0518
  296. 002e:Call gdi32.CreateBitmap(00000080,00000020,00000001,00000001,00000000) ret=411d0735
  297. 002e:Ret gdi32.CreateBitmap() retval=000002ac ret=411d0735
  298. 002e:Call gdi32.SelectObject(00000298,000002ac) ret=411d0754
  299. 002e:Ret gdi32.SelectObject() retval=0000006c ret=411d0754
  300. 002e:Call gdi32.CreateBitmap(00000008,00000008,00000001,00000001,4125647a) ret=411d057a
  301. 002e:Ret gdi32.CreateBitmap() retval=000002b0 ret=411d057a
  302. 002e:Call gdi32.CreatePatternBrush(000002b0) ret=411d058a
  303. 002e:Ret gdi32.CreatePatternBrush() retval=000002b8 ret=411d058a
  304. 002e:Call gdi32.DeleteObject(000002b0) ret=411d0598
  305. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411d0598
  306. 002e:Call gdi32.CreateBitmap(00000008,00000008,00000001,00000001,4125646a) ret=411d05c9
  307. 002e:Ret gdi32.CreateBitmap() retval=000002bc ret=411d05c9
  308. 002e:Call gdi32.CreatePatternBrush(000002bc) ret=411d05d9
  309. 002e:Ret gdi32.CreatePatternBrush() retval=000002c4 ret=411d05d9
  310. 002e:Call gdi32.DeleteObject(000002bc) ret=411d05e7
  311. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411d05e7
  312. 002e:Ret comctl32.ImageList_Create() retval=0015a938 ret=413fb9f6
  313. 002e:Call comctl32.ImageList_SetBkColor(00158c30,ffffffff) ret=413fba19
  314. 002e:Ret comctl32.ImageList_SetBkColor() retval=ffffffff ret=413fba19
  315. 002e:Call comctl32.ImageList_SetBkColor(0015a938,ffffffff) ret=413fba34
  316. 002e:Ret comctl32.ImageList_SetBkColor() retval=ffffffff ret=413fba34
  317. 002e:Call user32.LoadImageA(413d0000,00000001,00000001,00000010,00000010,00008000) ret=413fba67
  318. 002e:Ret user32.LoadImageA() retval=000900a0 ret=413fba67
  319. 002e:Call user32.LoadImageA(413d0000,00000001,00000001,00000020,00000020,00008000) ret=413fba9c
  320. 002e:Ret user32.LoadImageA() retval=000f002a ret=413fba9c
  321. 002e:Call KERNEL32.LoadLibraryA(4147b02c "ole32.dll") ret=4145b37b
  322. 002e:Call PE DLL (proc=0x419847e0,module=0x41940000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=0x0)
  323. 002e:Ret PE DLL (proc=0x419847e0,module=0x41940000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=0x0) retval=1
  324. 002e:Call PE DLL (proc=0x418cae50,module=0x41800000 L"ole32.dll",reason=PROCESS_ATTACH,res=0x0)
  325. 002e:Call user32.RegisterClassW(0033f2e8) ret=4181457a
  326. 002e:Ret user32.RegisterClassW() retval=0000c015 ret=4181457a
  327. 002e:Ret PE DLL (proc=0x418cae50,module=0x41800000 L"ole32.dll",reason=PROCESS_ATTACH,res=0x0) retval=1
  328. 002e:Ret KERNEL32.LoadLibraryA() retval=41800000 ret=4145b37b
  329. 002e:Call KERNEL32.GetProcAddress(41800000,4147b0ab "CoTaskMemAlloc") ret=4145b34c
  330. 002e:Ret KERNEL32.GetProcAddress() retval=41801dd8 ret=4145b34c
  331. 002e:Call ole32.CoTaskMemAlloc(00000014) ret=4141721c
  332. 002e:Ret ole32.CoTaskMemAlloc() retval=0015ff70 ret=4141721c
  333. 002e:Call KERNEL32.GetFullPathNameW(415d5a80 L"C:\\windows\\system32\\shell32.dll",00000104,0033fa48,00000000) ret=413fab66
  334. 002e:Ret KERNEL32.GetFullPathNameW() retval=0000001f ret=413fab66
  335. 002e:Call comctl32.DPA_InsertPtr(00158a18,00007fff,0015ff70) ret=413fac11
  336. 002e:Ret comctl32.DPA_InsertPtr() retval=00000000 ret=413fac11
  337. 002e:Call comctl32.ImageList_ReplaceIcon(00158c30,ffffffff,000900a0) ret=413fac3d
  338. 002e:Call user32.CopyImage(000900a0,00000001,00000010,00000010,00004000) ret=411ccbd1
  339. 002e:Ret user32.CopyImage() retval=000d0032 ret=411ccbd1
  340. 002e:Call user32.GetIconInfo(000d0032,0033f8fc) ret=411ccbfc
  341. 002e:Ret user32.GetIconInfo() retval=00000001 ret=411ccbfc
  342. 002e:Call gdi32.GetObjectW(0000038c,00000018,0033f8e4) ret=411ccc21
  343. 002e:Ret gdi32.GetObjectW() retval=00000018 ret=411ccc21
  344. 002e:Call gdi32.CreateCompatibleDC(00000000) ret=411ccc42
  345. 002e:Ret gdi32.CreateCompatibleDC() retval=00000390 ret=411ccc42
  346. 002e:Call gdi32.GetObjectW(00000370,00000018,0033f858) ret=411cc41e
  347. 002e:Ret gdi32.GetObjectW() retval=00000018 ret=411cc41e
  348. 002e:Call gdi32.SelectObject(00000390,00000370) ret=411cc451
  349. 002e:Ret gdi32.SelectObject() retval=0000006c ret=411cc451
  350. 002e:Call gdi32.GetDIBits(00000390,00000370,00000000,00000010,001629d0,001625a0,00000000) ret=411cc533
  351. 002e:Ret gdi32.GetDIBits() retval=00000010 ret=411cc533
  352. 002e:Call gdi32.GetDIBits(00000390,0000038c,00000000,00000010,00162dd8,00161c30,00000000) ret=411cc659
  353. 002e:Ret gdi32.GetDIBits() retval=00000010 ret=411cc659
  354. 002e:Call gdi32.StretchDIBits(00000250,00000000,00000000,00000010,00000010,00000000,00000000,00000010,00000010,001629d0,001625a0,00000000,00cc0020) ret=411ccaca
  355. 002e:Ret gdi32.StretchDIBits() retval=00000010 ret=411ccaca
  356. 002e:Call gdi32.StretchDIBits(0000025c,00000000,00000000,00000010,00000010,00000000,00000000,00000010,00000010,00162dd8,00161c30,00000000,00cc0020) ret=411cc8ad
  357. 002e:Ret gdi32.StretchDIBits() retval=00000010 ret=411cc8ad
  358. 002e:Call user32.DestroyIcon(000d0032) ret=411ccddc
  359. 002e:Ret user32.DestroyIcon() retval=00000001 ret=411ccddc
  360. 002e:Call gdi32.DeleteDC(00000390) ret=411ccdf1
  361. 002e:Ret gdi32.DeleteDC() retval=00000001 ret=411ccdf1
  362. 002e:Call gdi32.DeleteObject(00000370) ret=411cce03
  363. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411cce03
  364. 002e:Call gdi32.DeleteObject(0000038c) ret=411cce15
  365. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411cce15
  366. 002e:Ret comctl32.ImageList_ReplaceIcon() retval=00000000 ret=413fac3d
  367. 002e:Call comctl32.ImageList_ReplaceIcon(0015a938,ffffffff,000f002a) ret=413fac61
  368. 002e:Call user32.CopyImage(000f002a,00000001,00000020,00000020,00004000) ret=411ccbd1
  369. 002e:Ret user32.CopyImage() retval=000e0032 ret=411ccbd1
  370. 002e:Call user32.GetIconInfo(000e0032,0033f8fc) ret=411ccbfc
  371. 002e:Ret user32.GetIconInfo() retval=00000001 ret=411ccbfc
  372. 002e:Call gdi32.GetObjectW(00000404,00000018,0033f8e4) ret=411ccc21
  373. 002e:Ret gdi32.GetObjectW() retval=00000018 ret=411ccc21
  374. 002e:Call gdi32.CreateCompatibleDC(00000000) ret=411ccc42
  375. 002e:Ret gdi32.CreateCompatibleDC() retval=00000408 ret=411ccc42
  376. 002e:Call gdi32.GetObjectW(000003e8,00000018,0033f858) ret=411cc41e
  377. 002e:Ret gdi32.GetObjectW() retval=00000018 ret=411cc41e
  378. 002e:Call gdi32.SelectObject(00000408,000003e8) ret=411cc451
  379. 002e:Ret gdi32.SelectObject() retval=0000006c ret=411cc451
  380. 002e:Call gdi32.GetDIBits(00000408,000003e8,00000000,00000020,001635d0,001631a0,00000000) ret=411cc533
  381. 002e:Ret gdi32.GetDIBits() retval=00000020 ret=411cc533
  382. 002e:Call gdi32.GetDIBits(00000408,00000404,00000000,00000020,001645d8,00161c30,00000000) ret=411cc659
  383. 002e:Ret gdi32.GetDIBits() retval=00000020 ret=411cc659
  384. 002e:Call gdi32.StretchDIBits(0000028c,00000000,00000000,00000020,00000020,00000000,00000000,00000020,00000020,001635d0,001631a0,00000000,00cc0020) ret=411ccaca
  385. 002e:Ret gdi32.StretchDIBits() retval=00000020 ret=411ccaca
  386. 002e:Call gdi32.StretchDIBits(00000298,00000000,00000000,00000020,00000020,00000000,00000000,00000020,00000020,001645d8,00161c30,00000000,00cc0020) ret=411cc8ad
  387. 002e:Ret gdi32.StretchDIBits() retval=00000020 ret=411cc8ad
  388. 002e:Call user32.DestroyIcon(000e0032) ret=411ccddc
  389. 002e:Ret user32.DestroyIcon() retval=00000001 ret=411ccddc
  390. 002e:Call gdi32.DeleteDC(00000408) ret=411ccdf1
  391. 002e:Ret gdi32.DeleteDC() retval=00000001 ret=411ccdf1
  392. 002e:Call gdi32.DeleteObject(000003e8) ret=411cce03
  393. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411cce03
  394. 002e:Call gdi32.DeleteObject(00000404) ret=411cce15
  395. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411cce15
  396. 002e:Ret comctl32.ImageList_ReplaceIcon() retval=00000000 ret=413fac61
  397. 002e:Call ole32.CoTaskMemAlloc(00000014) ret=4141721c
  398. 002e:Ret ole32.CoTaskMemAlloc() retval=0015ff90 ret=4141721c
  399. 002e:Call KERNEL32.GetFullPathNameW(415d5a80 L"C:\\windows\\system32\\shell32.dll",00000104,0033fa48,00000000) ret=413fab66
  400. 002e:Ret KERNEL32.GetFullPathNameW() retval=0000001f ret=413fab66
  401. 002e:Call comctl32.DPA_InsertPtr(00158a18,00007fff,0015ff90) ret=413fac11
  402. 002e:Ret comctl32.DPA_InsertPtr() retval=00000001 ret=413fac11
  403. 002e:Call comctl32.ImageList_ReplaceIcon(00158c30,ffffffff,000900a0) ret=413fac3d
  404. 002e:Call user32.CopyImage(000900a0,00000001,00000010,00000010,00004000) ret=411ccbd1
  405. 002e:Ret user32.CopyImage() retval=000f0032 ret=411ccbd1
  406. 002e:Call user32.GetIconInfo(000f0032,0033f8fc) ret=411ccbfc
  407. 002e:Ret user32.GetIconInfo() retval=00000001 ret=411ccbfc
  408. 002e:Call gdi32.GetObjectW(0000047c,00000018,0033f8e4) ret=411ccc21
  409. 002e:Ret gdi32.GetObjectW() retval=00000018 ret=411ccc21
  410. 002e:Call gdi32.CreateCompatibleDC(00000000) ret=411cb889
  411. 002e:Ret gdi32.CreateCompatibleDC() retval=00000480 ret=411cb889
  412. 002e:Call KERNEL32.LocalAlloc(00000040,00000028) ret=411b86d3
  413. 002e:Ret KERNEL32.LocalAlloc() retval=0015f660 ret=411b86d3
  414. 002e:Call gdi32.CreateDIBSection(00000480,0015f660,00000000,0033f7fc,00000000,00000000) ret=411cb607
  415. 002e:Ret gdi32.CreateDIBSection() retval=0000048c ret=411cb607
  416. 002e:Call KERNEL32.LocalFree(0015f660) ret=411b841b
  417. 002e:Ret KERNEL32.LocalFree() retval=00000000 ret=411b841b
  418. 002e:Call gdi32.SelectObject(00000480,0000048c) ret=411cb9d2
  419. 002e:Ret gdi32.SelectObject() retval=0000006c ret=411cb9d2
  420. 002e:Call gdi32.BitBlt(00000480,00000000,00000000,00000040,00000090,00000250,00000000,00000000,00cc0020) ret=411cba1f
  421. 002e:Ret gdi32.BitBlt() retval=00000001 ret=411cba1f
  422. 002e:Call gdi32.SelectObject(00000480,0000006c) ret=411cba31
  423. 002e:Ret gdi32.SelectObject() retval=0000048c ret=411cba31
  424. 002e:Call gdi32.SelectObject(00000250,0000048c) ret=411cb8c1
  425. 002e:Ret gdi32.SelectObject() retval=00000268 ret=411cb8c1
  426. 002e:Call gdi32.DeleteObject(00000268) ret=411cb8cf
  427. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411cb8cf
  428. 002e:Call gdi32.CreateBitmap(00000040,00000090,00000001,00000001,00000000) ret=411cb96a
  429. 002e:Ret gdi32.CreateBitmap() retval=00000494 ret=411cb96a
  430. 002e:Call gdi32.SelectObject(00000480,00000494) ret=411cbad7
  431. 002e:Ret gdi32.SelectObject() retval=0000006c ret=411cbad7
  432. 002e:Call gdi32.BitBlt(00000480,00000000,00000000,00000040,00000090,0000025c,00000000,00000000,00cc0020) ret=411cbb24
  433. 002e:Ret gdi32.BitBlt() retval=00000001 ret=411cbb24
  434. 002e:Call gdi32.SelectObject(00000480,0000006c) ret=411cbb36
  435. 002e:Ret gdi32.SelectObject() retval=00000494 ret=411cbb36
  436. 002e:Call gdi32.SelectObject(0000025c,00000494) ret=411cb995
  437. 002e:Ret gdi32.SelectObject() retval=00000270 ret=411cb995
  438. 002e:Call gdi32.DeleteObject(00000270) ret=411cb9a3
  439. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411cb9a3
  440. 002e:Call gdi32.DeleteDC(00000480) ret=411cb92e
  441. 002e:Ret gdi32.DeleteDC() retval=00000001 ret=411cb92e
  442. 002e:Call gdi32.CreateCompatibleDC(00000000) ret=411ccc42
  443. 002e:Ret gdi32.CreateCompatibleDC() retval=00000498 ret=411ccc42
  444. 002e:Call gdi32.GetObjectW(00000460,00000018,0033f858) ret=411cc41e
  445. 002e:Ret gdi32.GetObjectW() retval=00000018 ret=411cc41e
  446. 002e:Call gdi32.SelectObject(00000498,00000460) ret=411cc451
  447. 002e:Ret gdi32.SelectObject() retval=0000006c ret=411cc451
  448. 002e:Call gdi32.GetDIBits(00000498,00000460,00000000,00000010,00159718,001592e8,00000000) ret=411cc533
  449. 002e:Ret gdi32.GetDIBits() retval=00000010 ret=411cc533
  450. 002e:Call gdi32.GetDIBits(00000498,0000047c,00000000,00000010,00159b20,00161c58,00000000) ret=411cc659
  451. 002e:Ret gdi32.GetDIBits() retval=00000010 ret=411cc659
  452. 002e:Call gdi32.StretchDIBits(00000250,00000010,00000000,00000010,00000010,00000000,00000000,00000010,00000010,00159718,001592e8,00000000,00cc0020) ret=411ccaca
  453. 002e:Ret gdi32.StretchDIBits() retval=00000010 ret=411ccaca
  454. 002e:Call gdi32.StretchDIBits(0000025c,00000010,00000000,00000010,00000010,00000000,00000000,00000010,00000010,00159b20,00161c58,00000000,00cc0020) ret=411cc8ad
  455. 002e:Ret gdi32.StretchDIBits() retval=00000010 ret=411cc8ad
  456. 002e:Call user32.DestroyIcon(000f0032) ret=411ccddc
  457. 002e:Ret user32.DestroyIcon() retval=00000001 ret=411ccddc
  458. 002e:Call gdi32.DeleteDC(00000498) ret=411ccdf1
  459. 002e:Ret gdi32.DeleteDC() retval=00000001 ret=411ccdf1
  460. 002e:Call gdi32.DeleteObject(00000460) ret=411cce03
  461. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411cce03
  462. 002e:Call gdi32.DeleteObject(0000047c) ret=411cce15
  463. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411cce15
  464. 002e:Ret comctl32.ImageList_ReplaceIcon() retval=00000001 ret=413fac3d
  465. 002e:Call comctl32.ImageList_ReplaceIcon(0015a938,ffffffff,000f002a) ret=413fac61
  466. 002e:Call user32.CopyImage(000f002a,00000001,00000020,00000020,00004000) ret=411ccbd1
  467. 002e:Ret user32.CopyImage() retval=00100032 ret=411ccbd1
  468. 002e:Call user32.GetIconInfo(00100032,0033f8fc) ret=411ccbfc
  469. 002e:Ret user32.GetIconInfo() retval=00000001 ret=411ccbfc
  470. 002e:Call gdi32.GetObjectW(0000050c,00000018,0033f8e4) ret=411ccc21
  471. 002e:Ret gdi32.GetObjectW() retval=00000018 ret=411ccc21
  472. 002e:Call gdi32.CreateCompatibleDC(00000000) ret=411cb889
  473. 002e:Ret gdi32.CreateCompatibleDC() retval=00000510 ret=411cb889
  474. 002e:Call KERNEL32.LocalAlloc(00000040,00000028) ret=411b86d3
  475. 002e:Ret KERNEL32.LocalAlloc() retval=0015a3d0 ret=411b86d3
  476. 002e:Call gdi32.CreateDIBSection(00000510,0015a3d0,00000000,0033f7fc,00000000,00000000) ret=411cb607
  477. 002e:Ret gdi32.CreateDIBSection() retval=0000051c ret=411cb607
  478. 002e:Call KERNEL32.LocalFree(0015a3d0) ret=411b841b
  479. 002e:Ret KERNEL32.LocalFree() retval=00000000 ret=411b841b
  480. 002e:Call gdi32.SelectObject(00000510,0000051c) ret=411cb9d2
  481. 002e:Ret gdi32.SelectObject() retval=0000006c ret=411cb9d2
  482. 002e:Call gdi32.BitBlt(00000510,00000000,00000000,00000080,00000120,0000028c,00000000,00000000,00cc0020) ret=411cba1f
  483. 002e:Ret gdi32.BitBlt() retval=00000001 ret=411cba1f
  484. 002e:Call gdi32.SelectObject(00000510,0000006c) ret=411cba31
  485. 002e:Ret gdi32.SelectObject() retval=0000051c ret=411cba31
  486. 002e:Call gdi32.SelectObject(0000028c,0000051c) ret=411cb8c1
  487. 002e:Ret gdi32.SelectObject() retval=000002a4 ret=411cb8c1
  488. 002e:Call gdi32.DeleteObject(000002a4) ret=411cb8cf
  489. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411cb8cf
  490. 002e:Call gdi32.CreateBitmap(00000080,00000120,00000001,00000001,00000000) ret=411cb96a
  491. 002e:Ret gdi32.CreateBitmap() retval=00000524 ret=411cb96a
  492. 002e:Call gdi32.SelectObject(00000510,00000524) ret=411cbad7
  493. 002e:Ret gdi32.SelectObject() retval=0000006c ret=411cbad7
  494. 002e:Call gdi32.BitBlt(00000510,00000000,00000000,00000080,00000120,00000298,00000000,00000000,00cc0020) ret=411cbb24
  495. 002e:Ret gdi32.BitBlt() retval=00000001 ret=411cbb24
  496. 002e:Call gdi32.SelectObject(00000510,0000006c) ret=411cbb36
  497. 002e:Ret gdi32.SelectObject() retval=00000524 ret=411cbb36
  498. 002e:Call gdi32.SelectObject(00000298,00000524) ret=411cb995
  499. 002e:Ret gdi32.SelectObject() retval=000002ac ret=411cb995
  500. 002e:Call gdi32.DeleteObject(000002ac) ret=411cb9a3
  501. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411cb9a3
  502. 002e:Call gdi32.DeleteDC(00000510) ret=411cb92e
  503. 002e:Ret gdi32.DeleteDC() retval=00000001 ret=411cb92e
  504. 002e:Call gdi32.CreateCompatibleDC(00000000) ret=411ccc42
  505. 002e:Ret gdi32.CreateCompatibleDC() retval=00000528 ret=411ccc42
  506. 002e:Call gdi32.GetObjectW(000004f0,00000018,0033f858) ret=411cc41e
  507. 002e:Ret gdi32.GetObjectW() retval=00000018 ret=411cc41e
  508. 002e:Call gdi32.SelectObject(00000528,000004f0) ret=411cc451
  509. 002e:Ret gdi32.SelectObject() retval=0000006c ret=411cc451
  510. 002e:Call gdi32.GetDIBits(00000528,000004f0,00000000,00000020,0015b400,0015afd0,00000000) ret=411cc533
  511. 002e:Ret gdi32.GetDIBits() retval=00000020 ret=411cc533
  512. 002e:Call gdi32.GetDIBits(00000528,0000050c,00000000,00000020,0015c408,00162188,00000000) ret=411cc659
  513. 002e:Ret gdi32.GetDIBits() retval=00000020 ret=411cc659
  514. 002e:Call gdi32.StretchDIBits(0000028c,00000020,00000000,00000020,00000020,00000000,00000000,00000020,00000020,0015b400,0015afd0,00000000,00cc0020) ret=411ccaca
  515. 002e:Ret gdi32.StretchDIBits() retval=00000020 ret=411ccaca
  516. 002e:Call gdi32.StretchDIBits(00000298,00000020,00000000,00000020,00000020,00000000,00000000,00000020,00000020,0015c408,00162188,00000000,00cc0020) ret=411cc8ad
  517. 002e:Ret gdi32.StretchDIBits() retval=00000020 ret=411cc8ad
  518. 002e:Call user32.DestroyIcon(00100032) ret=411ccddc
  519. 002e:Ret user32.DestroyIcon() retval=00000001 ret=411ccddc
  520. 002e:Call gdi32.DeleteDC(00000528) ret=411ccdf1
  521. 002e:Ret gdi32.DeleteDC() retval=00000001 ret=411ccdf1
  522. 002e:Call gdi32.DeleteObject(000004f0) ret=411cce03
  523. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411cce03
  524. 002e:Call gdi32.DeleteObject(0000050c) ret=411cce15
  525. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411cce15
  526. 002e:Ret comctl32.ImageList_ReplaceIcon() retval=00000001 ret=413fac61
  527. 002e:Ret PE DLL (proc=0x4145b3c0,module=0x413d0000 L"shell32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
  528. 002e:Call PE DLL (proc=0x416bf6f0,module=0x416a0000 L"winspool.drv",reason=PROCESS_ATTACH,res=0x1)
  529. 002e:Call KERNEL32.DisableThreadLibraryCalls(416a0000) ret=416bf551
  530. 002e:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=416bf551
  531. 002e:Call advapi32.RegCreateKeyW(80000002,416c22a0 L"System\\CurrentControlSet\\Control\\Print\\Printers",0033fba4) ret=416be255
  532. 002e:Ret advapi32.RegCreateKeyW() retval=00000000 ret=416be255
  533. 002e:Call advapi32.RegQueryInfoKeyA(00000034,00000000,00000000,00000000,0033fb98,00000000,00000000,00000000,00000000,00000000,00000000,00000000) ret=416bedf6
  534. 002e:Ret advapi32.RegQueryInfoKeyA() retval=00000000 ret=416bedf6
  535. 002e:Call advapi32.RegCloseKey(00000034) ret=416bef04
  536. 002e:Ret advapi32.RegCloseKey() retval=00000000 ret=416bef04
  537. 002e:Call advapi32.RegCreateKeyW(80000002,416c22a0 L"System\\CurrentControlSet\\Control\\Print\\Printers",0033f55c) ret=416b533d
  538. 002e:Ret advapi32.RegCreateKeyW() retval=00000000 ret=416b533d
  539. 002e:Call advapi32.RegQueryInfoKeyA(00000034,00000000,00000000,00000000,0033f550,00000000,00000000,00000000,00000000,00000000,00000000,00000000) ret=416b548b
  540. 002e:Ret advapi32.RegQueryInfoKeyA() retval=00000000 ret=416b548b
  541. 002e:Call advapi32.RegCloseKey(00000034) ret=416b572c
  542. 002e:Ret advapi32.RegCloseKey() retval=00000000 ret=416b572c
  543. 002e:Call ntdll.RtlFreeUnicodeString(0033f5e8) ret=416bbe2f
  544. 002e:Ret ntdll.RtlFreeUnicodeString() retval=7bc5be00 ret=416bbe2f
  545. 002e:Call advapi32.RegCreateKeyW(80000002,416c22a0 L"System\\CurrentControlSet\\Control\\Print\\Printers",0033f55c) ret=416b533d
  546. 002e:Ret advapi32.RegCreateKeyW() retval=00000000 ret=416b533d
  547. 002e:Call advapi32.RegQueryInfoKeyA(00000034,00000000,00000000,00000000,0033f550,00000000,00000000,00000000,00000000,00000000,00000000,00000000) ret=416b548b
  548. 002e:Ret advapi32.RegQueryInfoKeyA() retval=00000000 ret=416b548b
  549. 002e:Call advapi32.RegCloseKey(00000034) ret=416b572c
  550. 002e:Ret advapi32.RegCloseKey() retval=00000000 ret=416b572c
  551. 002e:Call ntdll.RtlFreeUnicodeString(0033f5e8) ret=416bbe2f
  552. 002e:Ret ntdll.RtlFreeUnicodeString() retval=7bc5be00 ret=416bbe2f
  553. 002e:Ret PE DLL (proc=0x416bf6f0,module=0x416a0000 L"winspool.drv",reason=PROCESS_ATTACH,res=0x1) retval=1
  554. 002e:Call PE DLL (proc=0x412f14b0,module=0x412c0000 L"comdlg32.dll",reason=PROCESS_ATTACH,res=0x1)
  555. 002e:Call KERNEL32.DisableThreadLibraryCalls(412c0000) ret=412c428e
  556. 002e:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=412c428e
  557. 002e:Call KERNEL32.GetModuleHandleA(412f1ba1 "SHELL32.DLL") ret=412c429f
  558. 002e:Ret KERNEL32.GetModuleHandleA() retval=413d0000 ret=412c429f
  559. 002e:Call KERNEL32.GetProcAddress(413d0000,00000015) ret=412c42b8
  560. 002e:Ret KERNEL32.GetProcAddress() retval=413dbe4c ret=412c42b8
  561. 002e:Call KERNEL32.GetProcAddress(413d0000,00000019) ret=412c42e1
  562. 002e:Ret KERNEL32.GetProcAddress() retval=413dbeac ret=412c42e1
  563. 002e:Call KERNEL32.GetProcAddress(413d0000,00000099) ret=412c430a
  564. 002e:Ret KERNEL32.GetProcAddress() retval=413dc9d4 ret=412c430a
  565. 002e:Call KERNEL32.GetProcAddress(413d0000,00000012) ret=412c4333
  566. 002e:Ret KERNEL32.GetProcAddress() retval=413dbe04 ret=412c4333
  567. 002e:Call KERNEL32.GetProcAddress(413d0000,00000011) ret=412c435c
  568. 002e:Ret KERNEL32.GetProcAddress() retval=413dbdec ret=412c435c
  569. 002e:Call KERNEL32.GetProcAddress(413d0000,00000098) ret=412c4385
  570. 002e:Ret KERNEL32.GetProcAddress() retval=413dc9bc ret=412c4385
  571. 002e:Call KERNEL32.GetProcAddress(413d0000,000000a2) ret=412c43ae
  572. 002e:Ret KERNEL32.GetProcAddress() retval=413dca94 ret=412c43ae
  573. 002e:Call KERNEL32.GetProcAddress(413d0000,000000c4) ret=412c43d7
  574. 002e:Ret KERNEL32.GetProcAddress() retval=413dcd4c ret=412c43d7
  575. 002e:Call KERNEL32.GetProcAddress(413d0000,000000c3) ret=412c4400
  576. 002e:Ret KERNEL32.GetProcAddress() retval=413dcd34 ret=412c4400
  577. 002e:Call KERNEL32.GetProcAddress(413d0000,412f1bad "SHGetFolderPathW") ret=412c442b
  578. 002e:Ret KERNEL32.GetProcAddress() retval=413dd484 ret=412c442b
  579. 002e:Ret PE DLL (proc=0x412f14b0,module=0x412c0000 L"comdlg32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
  580. 002e:Call PE DLL (proc=0x41796f60,module=0x416e0000 L"oleaut32.dll",reason=PROCESS_ATTACH,res=0x1)
  581. 002e:Call KERNEL32.DisableThreadLibraryCalls(416e0000) ret=41796d48
  582. 002e:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=41796d48
  583. 002e:Ret PE DLL (proc=0x41796f60,module=0x416e0000 L"oleaut32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
  584. 002e:Starting process L"C:\\ESATAN-TMS\\r3sp3\\licences\\lmutil.exe" (entryproc=0x40121b)
  585. 002e:Call KERNEL32.GetSystemTimeAsFileTime(0033fea4) ret=00402931
  586. 002e:Ret KERNEL32.GetSystemTimeAsFileTime() retval=01cc9572 ret=00402931
  587. 002e:Call KERNEL32.GetCurrentProcessId() ret=0040293d
  588. 002e:Ret KERNEL32.GetCurrentProcessId() retval=0000002d ret=0040293d
  589. 002e:Call KERNEL32.GetCurrentThreadId() ret=00402945
  590. 002e:Ret KERNEL32.GetCurrentThreadId() retval=0000002e ret=00402945
  591. 002e:Call KERNEL32.GetTickCount() ret=0040294d
  592. 002e:Ret KERNEL32.GetTickCount() retval=00400bba ret=0040294d
  593. 002e:Call KERNEL32.QueryPerformanceCounter(0033fe9c) ret=00402959
  594. 002e:Ret KERNEL32.QueryPerformanceCounter() retval=00000001 ret=00402959
  595. 002e:Call KERNEL32.GetVersionExA(00161b50) ret=004010a9
  596. 002e:Ret KERNEL32.GetVersionExA() retval=00000001 ret=004010a9
  597. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=004024ca
  598. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=004024ca
  599. 002e:Call KERNEL32.GetProcAddress(7b810000,0054aa04 "FlsAlloc") ret=004024e8
  600. 002e:Ret KERNEL32.GetProcAddress() retval=7b813bf0 ret=004024e8
  601. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9f8 "FlsGetValue") ret=004024f5
  602. 002e:Ret KERNEL32.GetProcAddress() retval=7b82d310 ret=004024f5
  603. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9ec "FlsSetValue") ret=00402502
  604. 002e:Ret KERNEL32.GetProcAddress() retval=7b82d380 ret=00402502
  605. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9e4 "FlsFree") ret=0040250f
  606. 002e:Ret KERNEL32.GetProcAddress() retval=7b813c08 ret=0040250f
  607. 002e:Call KERNEL32.TlsAlloc() ret=00402563
  608. 002e:Ret KERNEL32.TlsAlloc() retval=00000003 ret=00402563
  609. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=00402094
  610. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=00402094
  611. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  612. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  613. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9b4 "EncodePointer") ret=004020af
  614. 002e:Ret KERNEL32.GetProcAddress() retval=7bc154e8 ret=004020af
  615. 002e:Call ntdll.RtlEncodePointer(00000000) ret=004020b9
  616. 002e:Ret ntdll.RtlEncodePointer() retval=e16f5678 ret=004020b9
  617. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=00402094
  618. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=00402094
  619. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  620. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  621. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9b4 "EncodePointer") ret=004020af
  622. 002e:Ret KERNEL32.GetProcAddress() retval=7bc154e8 ret=004020af
  623. 002e:Call ntdll.RtlEncodePointer(0040298a) ret=004020b9
  624. 002e:Ret ntdll.RtlEncodePointer() retval=e12f7ff2 ret=004020b9
  625. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=00402094
  626. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=00402094
  627. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  628. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  629. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9b4 "EncodePointer") ret=004020af
  630. 002e:Ret KERNEL32.GetProcAddress() retval=7bc154e8 ret=004020af
  631. 002e:Call ntdll.RtlEncodePointer(0040154d) ret=004020b9
  632. 002e:Ret ntdll.RtlEncodePointer() retval=e12f4335 ret=004020b9
  633. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=00402094
  634. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=00402094
  635. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  636. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  637. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9b4 "EncodePointer") ret=004020af
  638. 002e:Ret KERNEL32.GetProcAddress() retval=7bc154e8 ret=004020af
  639. 002e:Call ntdll.RtlEncodePointer(7b813bf0) ret=004020b9
  640. 002e:Ret ntdll.RtlEncodePointer() retval=9aee6d88 ret=004020b9
  641. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=00402094
  642. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=00402094
  643. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  644. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  645. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9b4 "EncodePointer") ret=004020af
  646. 002e:Ret KERNEL32.GetProcAddress() retval=7bc154e8 ret=004020af
  647. 002e:Call ntdll.RtlEncodePointer(7b82d310) ret=004020b9
  648. 002e:Ret ntdll.RtlEncodePointer() retval=9aed8568 ret=004020b9
  649. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=00402094
  650. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=00402094
  651. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  652. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  653. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9b4 "EncodePointer") ret=004020af
  654. 002e:Ret KERNEL32.GetProcAddress() retval=7bc154e8 ret=004020af
  655. 002e:Call ntdll.RtlEncodePointer(7b82d380) ret=004020b9
  656. 002e:Ret ntdll.RtlEncodePointer() retval=9aed85f8 ret=004020b9
  657. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=00402094
  658. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=00402094
  659. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  660. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  661. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9b4 "EncodePointer") ret=004020af
  662. 002e:Ret KERNEL32.GetProcAddress() retval=7bc154e8 ret=004020af
  663. 002e:Call ntdll.RtlEncodePointer(7b813c08) ret=004020b9
  664. 002e:Ret ntdll.RtlEncodePointer() retval=9aee6a70 ret=004020b9
  665. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=0040210b
  666. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=0040210b
  667. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  668. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  669. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9d4 "DecodePointer") ret=00402126
  670. 002e:Ret KERNEL32.GetProcAddress() retval=7bc15248 ret=00402126
  671. 002e:Call ntdll.RtlDecodePointer(e16f5678) ret=00402130
  672. 002e:Ret ntdll.RtlDecodePointer() retval=00000000 ret=00402130
  673. 002e:Call KERNEL32.GetModuleHandleA(0054aa38 "kernel32.dll") ret=00403242
  674. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=00403242
  675. 002e:Call KERNEL32.GetProcAddress(7b810000,0054aa10 "InitializeCriticalSectionAndSpinCount") ret=00403252
  676. 002e:Ret KERNEL32.GetProcAddress() retval=7b815618 ret=00403252
  677. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=00402094
  678. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=00402094
  679. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  680. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  681. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9b4 "EncodePointer") ret=004020af
  682. 002e:Ret KERNEL32.GetProcAddress() retval=7bc154e8 ret=004020af
  683. 002e:Call ntdll.RtlEncodePointer(7b815618) ret=004020b9
  684. 002e:Ret ntdll.RtlEncodePointer() retval=9aee0060 ret=004020b9
  685. 002e:Call KERNEL32.InitializeCriticalSectionAndSpinCount(0057ba98,00000fa0) ret=00403274
  686. 002e:Ret KERNEL32.InitializeCriticalSectionAndSpinCount() retval=00000001 ret=00403274
  687. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=0040210b
  688. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=0040210b
  689. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  690. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  691. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9d4 "DecodePointer") ret=00402126
  692. 002e:Ret KERNEL32.GetProcAddress() retval=7bc15248 ret=00402126
  693. 002e:Call ntdll.RtlDecodePointer(9aee0060) ret=00402130
  694. 002e:Ret ntdll.RtlDecodePointer() retval=7b815618 ret=00402130
  695. 002e:Call KERNEL32.InitializeCriticalSectionAndSpinCount(0057bab0,00000fa0) ret=00403274
  696. 002e:Ret KERNEL32.InitializeCriticalSectionAndSpinCount() retval=00000001 ret=00403274
  697. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=0040210b
  698. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=0040210b
  699. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  700. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  701. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9d4 "DecodePointer") ret=00402126
  702. 002e:Ret KERNEL32.GetProcAddress() retval=7bc15248 ret=00402126
  703. 002e:Call ntdll.RtlDecodePointer(9aee0060) ret=00402130
  704. 002e:Ret ntdll.RtlDecodePointer() retval=7b815618 ret=00402130
  705. 002e:Call KERNEL32.InitializeCriticalSectionAndSpinCount(0057bac8,00000fa0) ret=00403274
  706. 002e:Ret KERNEL32.InitializeCriticalSectionAndSpinCount() retval=00000001 ret=00403274
  707. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=0040210b
  708. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=0040210b
  709. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  710. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  711. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9d4 "DecodePointer") ret=00402126
  712. 002e:Ret KERNEL32.GetProcAddress() retval=7bc15248 ret=00402126
  713. 002e:Call ntdll.RtlDecodePointer(9aee0060) ret=00402130
  714. 002e:Ret ntdll.RtlDecodePointer() retval=7b815618 ret=00402130
  715. 002e:Call KERNEL32.InitializeCriticalSectionAndSpinCount(0057bae0,00000fa0) ret=00403274
  716. 002e:Ret KERNEL32.InitializeCriticalSectionAndSpinCount() retval=00000001 ret=00403274
  717. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=0040210b
  718. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=0040210b
  719. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  720. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  721. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9d4 "DecodePointer") ret=00402126
  722. 002e:Ret KERNEL32.GetProcAddress() retval=7bc15248 ret=00402126
  723. 002e:Call ntdll.RtlDecodePointer(9aee0060) ret=00402130
  724. 002e:Ret ntdll.RtlDecodePointer() retval=7b815618 ret=00402130
  725. 002e:Call KERNEL32.InitializeCriticalSectionAndSpinCount(0057baf8,00000fa0) ret=00403274
  726. 002e:Ret KERNEL32.InitializeCriticalSectionAndSpinCount() retval=00000001 ret=00403274
  727. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=0040210b
  728. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=0040210b
  729. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  730. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  731. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9d4 "DecodePointer") ret=00402126
  732. 002e:Ret KERNEL32.GetProcAddress() retval=7bc15248 ret=00402126
  733. 002e:Call ntdll.RtlDecodePointer(9aee0060) ret=00402130
  734. 002e:Ret ntdll.RtlDecodePointer() retval=7b815618 ret=00402130
  735. 002e:Call KERNEL32.InitializeCriticalSectionAndSpinCount(0057bb10,00000fa0) ret=00403274
  736. 002e:Ret KERNEL32.InitializeCriticalSectionAndSpinCount() retval=00000001 ret=00403274
  737. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=0040210b
  738. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=0040210b
  739. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  740. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  741. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9d4 "DecodePointer") ret=00402126
  742. 002e:Ret KERNEL32.GetProcAddress() retval=7bc15248 ret=00402126
  743. 002e:Call ntdll.RtlDecodePointer(9aee0060) ret=00402130
  744. 002e:Ret ntdll.RtlDecodePointer() retval=7b815618 ret=00402130
  745. 002e:Call KERNEL32.InitializeCriticalSectionAndSpinCount(0057bb28,00000fa0) ret=00403274
  746. 002e:Ret KERNEL32.InitializeCriticalSectionAndSpinCount() retval=00000001 ret=00403274
  747. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=0040210b
  748. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=0040210b
  749. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  750. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  751. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9d4 "DecodePointer") ret=00402126
  752. 002e:Ret KERNEL32.GetProcAddress() retval=7bc15248 ret=00402126
  753. 002e:Call ntdll.RtlDecodePointer(9aee0060) ret=00402130
  754. 002e:Ret ntdll.RtlDecodePointer() retval=7b815618 ret=00402130
  755. 002e:Call KERNEL32.InitializeCriticalSectionAndSpinCount(0057bb40,00000fa0) ret=00403274
  756. 002e:Ret KERNEL32.InitializeCriticalSectionAndSpinCount() retval=00000001 ret=00403274
  757. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=0040210b
  758. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=0040210b
  759. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  760. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  761. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9d4 "DecodePointer") ret=00402126
  762. 002e:Ret KERNEL32.GetProcAddress() retval=7bc15248 ret=00402126
  763. 002e:Call ntdll.RtlDecodePointer(9aee0060) ret=00402130
  764. 002e:Ret ntdll.RtlDecodePointer() retval=7b815618 ret=00402130
  765. 002e:Call KERNEL32.InitializeCriticalSectionAndSpinCount(0057bb58,00000fa0) ret=00403274
  766. 002e:Ret KERNEL32.InitializeCriticalSectionAndSpinCount() retval=00000001 ret=00403274
  767. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=0040210b
  768. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=0040210b
  769. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  770. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  771. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9d4 "DecodePointer") ret=00402126
  772. 002e:Ret KERNEL32.GetProcAddress() retval=7bc15248 ret=00402126
  773. 002e:Call ntdll.RtlDecodePointer(9aee0060) ret=00402130
  774. 002e:Ret ntdll.RtlDecodePointer() retval=7b815618 ret=00402130
  775. 002e:Call KERNEL32.InitializeCriticalSectionAndSpinCount(0057bb70,00000fa0) ret=00403274
  776. 002e:Ret KERNEL32.InitializeCriticalSectionAndSpinCount() retval=00000001 ret=00403274
  777. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=0040210b
  778. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=0040210b
  779. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  780. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  781. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9d4 "DecodePointer") ret=00402126
  782. 002e:Ret KERNEL32.GetProcAddress() retval=7bc15248 ret=00402126
  783. 002e:Call ntdll.RtlDecodePointer(9aee0060) ret=00402130
  784. 002e:Ret ntdll.RtlDecodePointer() retval=7b815618 ret=00402130
  785. 002e:Call KERNEL32.InitializeCriticalSectionAndSpinCount(0057bb88,00000fa0) ret=00403274
  786. 002e:Ret KERNEL32.InitializeCriticalSectionAndSpinCount() retval=00000001 ret=00403274
  787. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=0040210b
  788. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=0040210b
  789. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  790. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  791. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9d4 "DecodePointer") ret=00402126
  792. 002e:Ret KERNEL32.GetProcAddress() retval=7bc15248 ret=00402126
  793. 002e:Call ntdll.RtlDecodePointer(9aee0060) ret=00402130
  794. 002e:Ret ntdll.RtlDecodePointer() retval=7b815618 ret=00402130
  795. 002e:Call KERNEL32.InitializeCriticalSectionAndSpinCount(0057bba0,00000fa0) ret=00403274
  796. 002e:Ret KERNEL32.InitializeCriticalSectionAndSpinCount() retval=00000001 ret=00403274
  797. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=0040210b
  798. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=0040210b
  799. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  800. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  801. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9d4 "DecodePointer") ret=00402126
  802. 002e:Ret KERNEL32.GetProcAddress() retval=7bc15248 ret=00402126
  803. 002e:Call ntdll.RtlDecodePointer(9aee0060) ret=00402130
  804. 002e:Ret ntdll.RtlDecodePointer() retval=7b815618 ret=00402130
  805. 002e:Call KERNEL32.InitializeCriticalSectionAndSpinCount(0057bbb8,00000fa0) ret=00403274
  806. 002e:Ret KERNEL32.InitializeCriticalSectionAndSpinCount() retval=00000001 ret=00403274
  807. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=0040210b
  808. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=0040210b
  809. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  810. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  811. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9d4 "DecodePointer") ret=00402126
  812. 002e:Ret KERNEL32.GetProcAddress() retval=7bc15248 ret=00402126
  813. 002e:Call ntdll.RtlDecodePointer(9aee0060) ret=00402130
  814. 002e:Ret ntdll.RtlDecodePointer() retval=7b815618 ret=00402130
  815. 002e:Call KERNEL32.InitializeCriticalSectionAndSpinCount(0057bbd0,00000fa0) ret=00403274
  816. 002e:Ret KERNEL32.InitializeCriticalSectionAndSpinCount() retval=00000001 ret=00403274
  817. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=0040210b
  818. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=0040210b
  819. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  820. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  821. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9d4 "DecodePointer") ret=00402126
  822. 002e:Ret KERNEL32.GetProcAddress() retval=7bc15248 ret=00402126
  823. 002e:Call ntdll.RtlDecodePointer(9aee6d88) ret=00402130
  824. 002e:Ret ntdll.RtlDecodePointer() retval=7b813bf0 ret=00402130
  825. 002e:Call KERNEL32.FlsAlloc(00402334) ret=004025e6
  826. 002e:Ret KERNEL32.FlsAlloc() retval=00000000 ret=004025e6
  827. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=0040210b
  828. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=0040210b
  829. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  830. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  831. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9d4 "DecodePointer") ret=00402126
  832. 002e:Ret KERNEL32.GetProcAddress() retval=7bc15248 ret=00402126
  833. 002e:Call ntdll.RtlDecodePointer(9aed85f8) ret=00402130
  834. 002e:Ret ntdll.RtlDecodePointer() retval=7b82d380 ret=00402130
  835. 002e:Call KERNEL32.GetModuleHandleA(0054a9c4 "KERNEL32.DLL") ret=004021fd
  836. 002e:Ret KERNEL32.GetModuleHandleA() retval=7b810000 ret=004021fd
  837. 002e:Call KERNEL32.GetModuleHandleA(00000000) ret=00402017
  838. 002e:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=00402017
  839. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9b4 "EncodePointer") ret=0040222d
  840. 002e:Ret KERNEL32.GetProcAddress() retval=7bc154e8 ret=0040222d
  841. 002e:Call KERNEL32.GetProcAddress(7b810000,0054a9d4 "DecodePointer") ret=0040223d
  842. 002e:Ret KERNEL32.GetProcAddress() retval=7bc15248 ret=0040223d
  843. 002e:Call KERNEL32.InterlockedIncrement(00555450) ret=00402263
  844. 002e:Ret KERNEL32.InterlockedIncrement() retval=00000001 ret=00402263
  845. 002e:Call KERNEL32.InterlockedIncrement(00555980) ret=004045a9
  846. 002e:Ret KERNEL32.InterlockedIncrement() retval=00000002 ret=004045a9
  847. 002e:Call KERNEL32.InterlockedIncrement(00555b44) ret=00404619
  848. 002e:Ret KERNEL32.InterlockedIncrement() retval=00000001 ret=00404619
  849. 002e:Call KERNEL32.GetCurrentThreadId() ret=0040262d
  850. 002e:Ret KERNEL32.GetCurrentThreadId() retval=0000002e ret=0040262d
  851. 002e:Call KERNEL32.GetStartupInfoA(0033fe08) ret=00401d7c
  852. 002e:Ret KERNEL32.GetStartupInfoA() retval=0033fe08 ret=00401d7c
  853. 002e:Call KERNEL32.GetStdHandle(fffffff6) ret=00401f1c
  854. 002e:Ret KERNEL32.GetStdHandle() retval=00000017 ret=00401f1c
  855. 002e:Call KERNEL32.GetFileType(00000017) ret=00401f2e
  856. 002e:Ret KERNEL32.GetFileType() retval=00000002 ret=00401f2e
  857. 002e:Call ntdll.RtlDecodePointer(9aee0060) ret=00402130
  858. 002e:Ret ntdll.RtlDecodePointer() retval=7b815618 ret=00402130
  859. 002e:Call KERNEL32.InitializeCriticalSectionAndSpinCount(005db364,00000fa0) ret=00403274
  860. 002e:Ret KERNEL32.InitializeCriticalSectionAndSpinCount() retval=00000001 ret=00403274
  861. 002e:Call KERNEL32.GetStdHandle(fffffff5) ret=00401f1c
  862. 002e:Ret KERNEL32.GetStdHandle() retval=00000004 ret=00401f1c
  863. 002e:Call KERNEL32.GetFileType(00000004) ret=00401f2e
  864. 002e:Ret KERNEL32.GetFileType() retval=00000001 ret=00401f2e
  865. 002e:Call ntdll.RtlDecodePointer(9aee0060) ret=00402130
  866. 002e:Ret ntdll.RtlDecodePointer() retval=7b815618 ret=00402130
  867. 002e:Call KERNEL32.InitializeCriticalSectionAndSpinCount(005db39c,00000fa0) ret=00403274
  868. 002e:Ret KERNEL32.InitializeCriticalSectionAndSpinCount() retval=00000001 ret=00403274
  869. 002e:Call KERNEL32.GetStdHandle(fffffff4) ret=00401f1c
  870. 002e:Ret KERNEL32.GetStdHandle() retval=00000008 ret=00401f1c
  871. 002e:Call KERNEL32.GetFileType(00000008) ret=00401f2e
  872. 002e:Ret KERNEL32.GetFileType() retval=00000001 ret=00401f2e
  873. 002e:Call ntdll.RtlDecodePointer(9aee0060) ret=00402130
  874. 002e:Ret ntdll.RtlDecodePointer() retval=7b815618 ret=00402130
  875. 002e:Call KERNEL32.InitializeCriticalSectionAndSpinCount(005db3d4,00000fa0) ret=00403274
  876. 002e:Ret KERNEL32.InitializeCriticalSectionAndSpinCount() retval=00000001 ret=00403274
  877. 002e:Call KERNEL32.SetHandleCount(00000020) ret=00401f86
  878. 002e:Ret KERNEL32.SetHandleCount() retval=00000020 ret=00401f86
  879. 002e:Call KERNEL32.GetCommandLineA() ret=00401164
  880. 002e:Ret KERNEL32.GetCommandLineA() retval=0015f398 ret=00401164
  881. 002e:Call KERNEL32.GetEnvironmentStringsW() ret=00401c4a
  882. 002e:Ret KERNEL32.GetEnvironmentStringsW() retval=00230000 ret=00401c4a
  883. 002e:Call KERNEL32.WideCharToMultiByte(00000000,00000000,00230000 L"DYLD_FALLBACK_LIBRARY_PATH=/opt/local/lib",0000083c,00000000,00000000,00000000,00000000) ret=00401cbf
  884. 002e:Ret KERNEL32.WideCharToMultiByte() retval=0000083c ret=00401cbf
  885. 002e:Call KERNEL32.WideCharToMultiByte(00000000,00000000,00230000 L"DYLD_FALLBACK_LIBRARY_PATH=/opt/local/lib",0000083c,005dba60,0000083c,00000000,00000000) ret=00401ce1
  886. 002e:Ret KERNEL32.WideCharToMultiByte() retval=0000083c ret=00401ce1
  887. 002e:Call KERNEL32.FreeEnvironmentStringsW(00230000) ret=00401cfe
  888. 002e:Ret KERNEL32.FreeEnvironmentStringsW() retval=00000001 ret=00401cfe
  889. 002e:Call KERNEL32.GetLastError() ret=004022ad
  890. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  891. 002e:Call KERNEL32.GetLastError() ret=004022ad
  892. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  893. 002e:Call KERNEL32.GetLastError() ret=004022ad
  894. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  895. 002e:Call KERNEL32.GetACP() ret=00403c3b
  896. 002e:Ret KERNEL32.GetACP() retval=000004e4 ret=00403c3b
  897. 002e:Call KERNEL32.GetLastError() ret=004022ad
  898. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  899. 002e:Call KERNEL32.IsValidCodePage(000004e4) ret=00403cdc
  900. 002e:Ret KERNEL32.IsValidCodePage() retval=00000001 ret=00403cdc
  901. 002e:Call KERNEL32.GetCPInfo(000004e4,0033fde8) ret=00403cef
  902. 002e:Ret KERNEL32.GetCPInfo() retval=00000001 ret=00403cef
  903. 002e:Call KERNEL32.GetCPInfo(000004e4,0033f8b4) ret=00403965
  904. 002e:Ret KERNEL32.GetCPInfo() retval=00000001 ret=00403965
  905. 002e:Call KERNEL32.GetLastError() ret=004022ad
  906. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  907. 002e:Call KERNEL32.GetStringTypeW(00000001,0054ab38 L"",00000001,0033f844) ret=00406467
  908. 002e:Ret KERNEL32.GetStringTypeW() retval=00000001 ret=00406467
  909. 002e:Call KERNEL32.MultiByteToWideChar(000004e4,00000001,0033fcc8 " \x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94"...,00000100,00000000,00000000) ret=004064da
  910. 002e:Ret KERNEL32.MultiByteToWideChar() retval=00000100 ret=004064da
  911. 002e:Call KERNEL32.MultiByteToWideChar(000004e4,00000001,0033fcc8 " \x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94"...,00000100,0033f638,00000100) ret=00406544
  912. 002e:Ret KERNEL32.MultiByteToWideChar() retval=00000100 ret=00406544
  913. 002e:Call KERNEL32.GetStringTypeW(00000001,0033f638 L" \0001\0002\0003\0004\0005\0006\0007\0008\t\n\000b\000c\r\000e\000f\0010\0011\0012\0013\0014\0015\0016\0017\0018\0019\001a\001b\001c\001d\001e\001f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\007f\20ac\0081\201a\0192\201e\2026\2020\2021\02c6\2030\0160"...,00000100,0033f8c8) ret=00406556
  914. 002e:Ret KERNEL32.GetStringTypeW() retval=00000001 ret=00406556
  915. 002e:Call KERNEL32.GetLastError() ret=004022ad
  916. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  917. 002e:Call KERNEL32.LCMapStringW(00000000,00000100,0054ab38 L"",00000001,00000000,00000000) ret=00406085
  918. 002e:Ret KERNEL32.LCMapStringW() retval=00000001 ret=00406085
  919. 002e:Call KERNEL32.MultiByteToWideChar(000004e4,00000001,0033fcc8 " \x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94"...,00000100,00000000,00000000) ret=0040611f
  920. 002e:Ret KERNEL32.MultiByteToWideChar() retval=00000100 ret=0040611f
  921. 002e:Call KERNEL32.MultiByteToWideChar(000004e4,00000001,0033fcc8 " \x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94"...,00000100,0033f5f8,00000100) ret=0040618b
  922. 002e:Ret KERNEL32.MultiByteToWideChar() retval=00000100 ret=0040618b
  923. 002e:Call KERNEL32.LCMapStringW(00000000,00000100,0033f5f8 L" \0001\0002\0003\0004\0005\0006\0007\0008\t\n\000b\000c\r\000e\000f\0010\0011\0012\0013\0014\0015\0016\0017\0018\0019\001a\001b\001c\001d\001e\001f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\007f\20ac\0081\201a\0192\201e\2026\2020\2021\02c6\2030\0160"...,00000100,00000000,00000000) ret=004061a7
  924. 002e:Ret KERNEL32.LCMapStringW() retval=00000100 ret=004061a7
  925. 002e:Call KERNEL32.LCMapStringW(00000000,00000100,0033f5f8 L" \0001\0002\0003\0004\0005\0006\0007\0008\t\n\000b\000c\r\000e\000f\0010\0011\0012\0013\0014\0015\0016\0017\0018\0019\001a\001b\001c\001d\001e\001f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\007f\20ac\0081\201a\0192\201e\2026\2020\2021\02c6\2030\0160"...,00000100,0033f3e8,00000100) ret=00406248
  926. 002e:Ret KERNEL32.LCMapStringW() retval=00000100 ret=00406248
  927. 002e:Call KERNEL32.WideCharToMultiByte(000004e4,00000000,0033f3e8 L" \0001\0002\0003\0004\0005\0006\0007\0008\t\n\000b\000c\r\000e\000f\0010\0011\0012\0013\0014\0015\0016\0017\0018\0019\001a\001b\001c\001d\001e\001f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\007f\20ac\0081\201a\0192\201e\2026\2020\2021\02c6\2030\0161"...,00000100,0033fbc8,00000100,00000000,00000000) ret=0040626b
  928. 002e:Ret KERNEL32.WideCharToMultiByte() retval=00000100 ret=0040626b
  929. 002e:Call KERNEL32.GetLastError() ret=004022ad
  930. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  931. 002e:Call KERNEL32.MultiByteToWideChar(000004e4,00000001,0033fcc8 " \x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94"...,00000100,00000000,00000000) ret=0040611f
  932. 002e:Ret KERNEL32.MultiByteToWideChar() retval=00000100 ret=0040611f
  933. 002e:Call KERNEL32.MultiByteToWideChar(000004e4,00000001,0033fcc8 " \x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94"...,00000100,0033f618,00000100) ret=0040618b
  934. 002e:Ret KERNEL32.MultiByteToWideChar() retval=00000100 ret=0040618b
  935. 002e:Call KERNEL32.LCMapStringW(00000000,00000200,0033f618 L" \0001\0002\0003\0004\0005\0006\0007\0008\t\n\000b\000c\r\000e\000f\0010\0011\0012\0013\0014\0015\0016\0017\0018\0019\001a\001b\001c\001d\001e\001f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\007f\20ac\0081\201a\0192\201e\2026\2020\2021\02c6\2030\0160"...,00000100,00000000,00000000) ret=004061a7
  936. 002e:Ret KERNEL32.LCMapStringW() retval=00000100 ret=004061a7
  937. 002e:Call KERNEL32.LCMapStringW(00000000,00000200,0033f618 L" \0001\0002\0003\0004\0005\0006\0007\0008\t\n\000b\000c\r\000e\000f\0010\0011\0012\0013\0014\0015\0016\0017\0018\0019\001a\001b\001c\001d\001e\001f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\007f\20ac\0081\201a\0192\201e\2026\2020\2021\02c6\2030\0160"...,00000100,0033f408,00000100) ret=00406248
  938. 002e:Ret KERNEL32.LCMapStringW() retval=00000100 ret=00406248
  939. 002e:Call KERNEL32.WideCharToMultiByte(000004e4,00000000,0033f408 L" \0001\0002\0003\0004\0005\0006\0007\0008\t\n\000b\000c\r\000e\000f\0010\0011\0012\0013\0014\0015\0016\0017\0018\0019\001a\001b\001c\001d\001e\001f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\007f\20ac\0081\201a\0191\201e\2026\2020\2021\02c6\2030\0160"...,00000100,0033fac8,00000100,00000000,00000000) ret=0040626b
  940. 002e:Ret KERNEL32.WideCharToMultiByte() retval=00000100 ret=0040626b
  941. 002e:Call KERNEL32.InterlockedDecrement(00555450) ret=00403eba
  942. 002e:Ret KERNEL32.InterlockedDecrement() retval=00000000 ret=00403eba
  943. 002e:Call KERNEL32.InterlockedIncrement(005dc2a8) ret=00403edb
  944. 002e:Ret KERNEL32.InterlockedIncrement() retval=00000001 ret=00403edb
  945. 002e:Call KERNEL32.InterlockedDecrement(00555450) ret=00403f71
  946. 002e:Ret KERNEL32.InterlockedDecrement() retval=ffffffff ret=00403f71
  947. 002e:Call KERNEL32.InterlockedIncrement(005dc2a8) ret=00403f91
  948. 002e:Ret KERNEL32.InterlockedIncrement() retval=00000002 ret=00403f91
  949. 002e:Call KERNEL32.GetModuleFileNameA(00000000,0057b970,00000104) ret=00401ba3
  950. 002e:Ret KERNEL32.GetModuleFileNameA() retval=00000027 ret=00401ba3
  951. 002e:Call KERNEL32.GetLastError() ret=004022ad
  952. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  953. 002e:Call KERNEL32.GetLastError() ret=004022ad
  954. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  955. 002e:Call KERNEL32.GetLastError() ret=004022ad
  956. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  957. 002e:Call KERNEL32.GetLastError() ret=004022ad
  958. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  959. 002e:Call KERNEL32.GetLastError() ret=004022ad
  960. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  961. 002e:Call KERNEL32.GetLastError() ret=004022ad
  962. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  963. 002e:Call KERNEL32.GetLastError() ret=004022ad
  964. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  965. 002e:Call KERNEL32.GetLastError() ret=004022ad
  966. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  967. 002e:Call KERNEL32.GetLastError() ret=004022ad
  968. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  969. 002e:Call KERNEL32.GetLastError() ret=004022ad
  970. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  971. 002e:Call KERNEL32.GetLastError() ret=004022ad
  972. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  973. 002e:Call KERNEL32.GetLastError() ret=004022ad
  974. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  975. 002e:Call KERNEL32.GetLastError() ret=004022ad
  976. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  977. 002e:Call KERNEL32.GetLastError() ret=004022ad
  978. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  979. 002e:Call KERNEL32.GetLastError() ret=004022ad
  980. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  981. 002e:Call KERNEL32.GetLastError() ret=004022ad
  982. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  983. 002e:Call KERNEL32.GetLastError() ret=004022ad
  984. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  985. 002e:Call KERNEL32.GetLastError() ret=004022ad
  986. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  987. 002e:Call KERNEL32.GetLastError() ret=004022ad
  988. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  989. 002e:Call KERNEL32.GetLastError() ret=004022ad
  990. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  991. 002e:Call KERNEL32.GetLastError() ret=004022ad
  992. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  993. 002e:Call KERNEL32.GetLastError() ret=004022ad
  994. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  995. 002e:Call KERNEL32.GetLastError() ret=004022ad
  996. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  997. 002e:Call KERNEL32.GetLastError() ret=004022ad
  998. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  999. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1000. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1001. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1002. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1003. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1004. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1005. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1006. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1007. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1008. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1009. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1010. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1011. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1012. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1013. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1014. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1015. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1016. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1017. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1018. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1019. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1020. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1021. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1022. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1023. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1024. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1025. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1026. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1027. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1028. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1029. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1030. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1031. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1032. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1033. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1034. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1035. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1036. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1037. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1038. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1039. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1040. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1041. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1042. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1043. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1044. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1045. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1046. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1047. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1048. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1049. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1050. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1051. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1052. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1053. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1054. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1055. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1056. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1057. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1058. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1059. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1060. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1061. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1062. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1063. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1064. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1065. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1066. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1067. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1068. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1069. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1070. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1071. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1072. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1073. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1074. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1075. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1076. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1077. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1078. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1079. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1080. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1081. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1082. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1083. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1084. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1085. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1086. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1087. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1088. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1089. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1090. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1091. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1092. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1093. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1094. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1095. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1096. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1097. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1098. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1099. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1100. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1101. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1102. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1103. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1104. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1105. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1106. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1107. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1108. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1109. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1110. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1111. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1112. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1113. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1114. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1115. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1116. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1117. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1118. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1119. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1120. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1121. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1122. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1123. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1124. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1125. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1126. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1127. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1128. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1129. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1130. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1131. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1132. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1133. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1134. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1135. 002e:Call ntdll.RtlEncodePointer(004055dd) ret=004020b9
  1136. 002e:Ret ntdll.RtlEncodePointer() retval=e12f03a5 ret=004020b9
  1137. 002e:Call ntdll.RtlEncodePointer(004055dd) ret=004020b9
  1138. 002e:Ret ntdll.RtlEncodePointer() retval=e12f03a5 ret=004020b9
  1139. 002e:Call ntdll.RtlEncodePointer(004055dd) ret=004020b9
  1140. 002e:Ret ntdll.RtlEncodePointer() retval=e12f03a5 ret=004020b9
  1141. 002e:Call ntdll.RtlEncodePointer(004055dd) ret=004020b9
  1142. 002e:Ret ntdll.RtlEncodePointer() retval=e12f03a5 ret=004020b9
  1143. 002e:Call ntdll.RtlEncodePointer(004055dd) ret=004020b9
  1144. 002e:Ret ntdll.RtlEncodePointer() retval=e12f03a5 ret=004020b9
  1145. 002e:Call ntdll.RtlEncodePointer(004055dd) ret=004020b9
  1146. 002e:Ret ntdll.RtlEncodePointer() retval=e12f03a5 ret=004020b9
  1147. 002e:Call ntdll.RtlEncodePointer(004055dd) ret=004020b9
  1148. 002e:Ret ntdll.RtlEncodePointer() retval=e12f03a5 ret=004020b9
  1149. 002e:Call ntdll.RtlEncodePointer(004055dd) ret=004020b9
  1150. 002e:Ret ntdll.RtlEncodePointer() retval=e12f03a5 ret=004020b9
  1151. 002e:Call ntdll.RtlEncodePointer(004055dd) ret=004020b9
  1152. 002e:Ret ntdll.RtlEncodePointer() retval=e12f03a5 ret=004020b9
  1153. 002e:Call ntdll.RtlEncodePointer(004055dd) ret=004020b9
  1154. 002e:Ret ntdll.RtlEncodePointer() retval=e12f03a5 ret=004020b9
  1155. 002e:Call ntdll.RtlEncodePointer(005dba60) ret=004020b9
  1156. 002e:Ret ntdll.RtlEncodePointer() retval=e132ec18 ret=004020b9
  1157. 002e:Call KERNEL32.SetUnhandledExceptionFilter(00401225) ret=0040126d
  1158. 002e:Ret KERNEL32.SetUnhandledExceptionFilter() retval=00000000 ret=0040126d
  1159. 002e:Call ntdll.RtlDecodePointer(e132ec18) ret=00402130
  1160. 002e:Ret ntdll.RtlDecodePointer() retval=005dba60 ret=00402130
  1161. 002e:Call ntdll.RtlDecodePointer(e132ec18) ret=00402130
  1162. 002e:Ret ntdll.RtlDecodePointer() retval=005dba60 ret=00402130
  1163. 002e:Call ntdll.RtlEncodePointer(00401fc5) ret=004020b9
  1164. 002e:Ret ntdll.RtlEncodePointer() retval=e12f49bd ret=004020b9
  1165. 002e:Call ntdll.RtlEncodePointer(005dba64) ret=004020b9
  1166. 002e:Ret ntdll.RtlEncodePointer() retval=e132ec1c ret=004020b9
  1167. 002e:Call KERNEL32.GetCommandLineW() ret=004a5f07
  1168. 002e:Ret KERNEL32.GetCommandLineW() retval=001150f8 ret=004a5f07
  1169. 002e:Call KERNEL32.WideCharToMultiByte(0000fde9,00000000,001150f8 L"C:\\ESATAN-TMS\\r3sp3\\licences\\lmutil.exe hostid",ffffffff,00000000,00000000,00000000,00000000) ret=004a5b6c
  1170. 002e:Ret KERNEL32.WideCharToMultiByte() retval=0000002f ret=004a5b6c
  1171. 002e:Call KERNEL32.WideCharToMultiByte(0000fde9,00000000,001150f8 L"C:\\ESATAN-TMS\\r3sp3\\licences\\lmutil.exe hostid",ffffffff,005dbae8,00000030,00000000,00000000) ret=004a5b6c
  1172. 002e:Ret KERNEL32.WideCharToMultiByte() retval=0000002f ret=004a5b6c
  1173. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1174. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1175. 002e:Call KERNEL32.GetSystemTimeAsFileTime(0033f9c4) ret=00488187
  1176. 002e:Ret KERNEL32.GetSystemTimeAsFileTime() retval=01cc9572 ret=00488187
  1177. 002e:Call KERNEL32.GetVersionExA(0033f960) ret=004af16a
  1178. 002e:Ret KERNEL32.GetVersionExA() retval=00000001 ret=004af16a
  1179. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1180. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1181. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1182. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1183. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1184. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1185. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1186. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1187. 002e:Call KERNEL32.GetVersionExA(0033f4bc) ret=004ac5cd
  1188. 002e:Ret KERNEL32.GetVersionExA() retval=00000001 ret=004ac5cd
  1189. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1190. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1191. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1192. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1193. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1194. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1195. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1196. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1197. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1198. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1199. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1200. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1201. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1202. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1203. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1204. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1205. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1206. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1207. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1208. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1209. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1210. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1211. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1212. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1213. 002e:Call advapi32.RegOpenKeyExA(80000002,005dc240 "SOFTWARE\\FLEXlm License Manager",00000000,00000001,0033f584) ret=004aacec
  1214. 002e:Ret advapi32.RegOpenKeyExA() retval=00000000 ret=004aacec
  1215. 002e:Call KERNEL32.GetVersionExA(0033f4a4) ret=004a567d
  1216. 002e:Ret KERNEL32.GetVersionExA() retval=00000001 ret=004a567d
  1217. 002e:Call KERNEL32.MultiByteToWideChar(0000fde9,00000000,0055dafc "FLEXLM_DIAGNOSTICS",ffffffff,00000000,00000000) ret=004a589e
  1218. 002e:Ret KERNEL32.MultiByteToWideChar() retval=00000013 ret=004a589e
  1219. 002e:Call KERNEL32.MultiByteToWideChar(0000fde9,00000000,0055dafc "FLEXLM_DIAGNOSTICS",ffffffff,005dc240,00000014) ret=004a589e
  1220. 002e:Ret KERNEL32.MultiByteToWideChar() retval=00000013 ret=004a589e
  1221. 002e:Call advapi32.RegQueryValueExW(00000034,005dc240 L"FLEXLM_DIAGNOSTICS",00000000,0033f570,00000000,0033f520) ret=004a6549
  1222. 002e:Ret advapi32.RegQueryValueExW() retval=00000002 ret=004a6549
  1223. 002e:Call advapi32.RegCloseKey(00000034) ret=004aad68
  1224. 002e:Ret advapi32.RegCloseKey() retval=00000000 ret=004aad68
  1225. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1226. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1227. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1228. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1229. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1230. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1231. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1232. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1233. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1234. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1235. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1236. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1237. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1238. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1239. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1240. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1241. 002e:Call KERNEL32.GetTimeZoneInformation(0057bfa8) ret=00408e28
  1242. 002e:Ret KERNEL32.GetTimeZoneInformation() retval=00000002 ret=00408e28
  1243. 002e:Call KERNEL32.WideCharToMultiByte(00000000,00000000,0057bfac L"GMT Standard Time",ffffffff,00555bb0,0000003f,00000000,0033f938) ret=00408ea2
  1244. 002e:Ret KERNEL32.WideCharToMultiByte() retval=00000012 ret=00408ea2
  1245. 002e:Call KERNEL32.WideCharToMultiByte(00000000,00000000,0057c000 L"GMT Daylight Time",ffffffff,00555bf0,0000003f,00000000,0033f938) ret=00408ed6
  1246. 002e:Ret KERNEL32.WideCharToMultiByte() retval=00000012 ret=00408ed6
  1247. 002e:Call KERNEL32.GetVersion() ret=004e5737
  1248. 002e:Ret KERNEL32.GetVersion() retval=0a280105 ret=004e5737
  1249. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1250. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1251. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1252. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1253. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1254. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1255. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1256. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1257. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1258. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1259. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1260. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1261. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1262. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1263. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1264. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1265. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1266. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1267. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1268. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1269. 002e:Call KERNEL32.GetVersionExA(0033f8c8) ret=004ac5cd
  1270. 002e:Ret KERNEL32.GetVersionExA() retval=00000001 ret=004ac5cd
  1271. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1272. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1273. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1274. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1275. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1276. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1277. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1278. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1279. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1280. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1281. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1282. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1283. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1284. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1285. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1286. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1287. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1288. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1289. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1290. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1291. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1292. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1293. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1294. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1295. 002e:Call advapi32.RegOpenKeyExA(80000002,005dc270 "SOFTWARE\\FLEXlm License Manager",00000000,00000001,0033f990) ret=004aacec
  1296. 002e:Ret advapi32.RegOpenKeyExA() retval=00000000 ret=004aacec
  1297. 002e:Call KERNEL32.MultiByteToWideChar(0000fde9,00000000,0055dadc "FLEXLM_BATCH",ffffffff,00000000,00000000) ret=004a589e
  1298. 002e:Ret KERNEL32.MultiByteToWideChar() retval=0000000d ret=004a589e
  1299. 002e:Call KERNEL32.MultiByteToWideChar(0000fde9,00000000,0055dadc "FLEXLM_BATCH",ffffffff,005dc270,0000000e) ret=004a589e
  1300. 002e:Ret KERNEL32.MultiByteToWideChar() retval=0000000d ret=004a589e
  1301. 002e:Call advapi32.RegQueryValueExW(00000034,005dc270 L"FLEXLM_BATCH",00000000,0033f97c,00000000,0033f92c) ret=004a6549
  1302. 002e:Ret advapi32.RegQueryValueExW() retval=00000002 ret=004a6549
  1303. 002e:Call advapi32.RegCloseKey(00000034) ret=004aad68
  1304. 002e:Ret advapi32.RegCloseKey() retval=00000000 ret=004aad68
  1305. 002e:Call KERNEL32.GetVersionExA(0033f8c8) ret=004ac5cd
  1306. 002e:Ret KERNEL32.GetVersionExA() retval=00000001 ret=004ac5cd
  1307. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1308. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1309. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1310. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1311. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1312. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1313. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1314. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1315. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1316. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1317. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1318. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1319. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1320. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1321. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1322. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1323. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1324. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1325. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1326. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1327. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1328. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1329. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1330. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1331. 002e:Call advapi32.RegOpenKeyExA(80000002,005dc270 "SOFTWARE\\FLEXlm License Manager",00000000,00000001,0033f990) ret=004aacec
  1332. 002e:Ret advapi32.RegOpenKeyExA() retval=00000000 ret=004aacec
  1333. 002e:Call KERNEL32.MultiByteToWideChar(0000fde9,00000000,0055da5c "FLEXLM_NO_CKOUT_INSTALL_LIC",ffffffff,00000000,00000000) ret=004a589e
  1334. 002e:Ret KERNEL32.MultiByteToWideChar() retval=0000001c ret=004a589e
  1335. 002e:Call KERNEL32.MultiByteToWideChar(0000fde9,00000000,0055da5c "FLEXLM_NO_CKOUT_INSTALL_LIC",ffffffff,005e1f50,0000001d) ret=004a589e
  1336. 002e:Ret KERNEL32.MultiByteToWideChar() retval=0000001c ret=004a589e
  1337. 002e:Call advapi32.RegQueryValueExW(00000034,005e1f50 L"FLEXLM_NO_CKOUT_INSTALL_LIC",00000000,0033f97c,00000000,0033f92c) ret=004a6549
  1338. 002e:Ret advapi32.RegQueryValueExW() retval=00000002 ret=004a6549
  1339. 002e:Call advapi32.RegCloseKey(00000034) ret=004aad68
  1340. 002e:Ret advapi32.RegCloseKey() retval=00000000 ret=004aad68
  1341. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1342. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1343. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1344. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1345. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1346. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1347. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1348. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1349. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1350. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1351. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1352. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1353. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1354. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1355. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1356. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1357. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1358. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1359. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1360. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1361. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1362. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1363. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1364. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1365. 002e:Call KERNEL32.GetVersionExA(0033f854) ret=004ac5cd
  1366. 002e:Ret KERNEL32.GetVersionExA() retval=00000001 ret=004ac5cd
  1367. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1368. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1369. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1370. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1371. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1372. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1373. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1374. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1375. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1376. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1377. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1378. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1379. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1380. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1381. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1382. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1383. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1384. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1385. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1386. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1387. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1388. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1389. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1390. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1391. 002e:Call advapi32.RegOpenKeyExA(80000002,005dc270 "SOFTWARE\\FLEXlm License Manager",00000000,00000001,0033f91c) ret=004aacec
  1392. 002e:Ret advapi32.RegOpenKeyExA() retval=00000000 ret=004aacec
  1393. 002e:Call KERNEL32.MultiByteToWideChar(0000fde9,00000000,0055daec "LM_BORROW",ffffffff,00000000,00000000) ret=004a589e
  1394. 002e:Ret KERNEL32.MultiByteToWideChar() retval=0000000a ret=004a589e
  1395. 002e:Call KERNEL32.MultiByteToWideChar(0000fde9,00000000,0055daec "LM_BORROW",ffffffff,005dc270,0000000b) ret=004a589e
  1396. 002e:Ret KERNEL32.MultiByteToWideChar() retval=0000000a ret=004a589e
  1397. 002e:Call advapi32.RegQueryValueExW(00000034,005dc270 L"LM_BORROW",00000000,0033f908,00000000,0033f8b8) ret=004a6549
  1398. 002e:Ret advapi32.RegQueryValueExW() retval=00000002 ret=004a6549
  1399. 002e:Call advapi32.RegCloseKey(00000034) ret=004aad68
  1400. 002e:Ret advapi32.RegCloseKey() retval=00000000 ret=004aad68
  1401. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1402. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1403. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1404. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1405. 002e:Call advapi32.RegOpenKeyExA(80000001,005dc270 "SOFTWARE\\FLEXlm License Manager\\Borrow",00000000,00000001,0033f91c) ret=004aacec
  1406. 002e:Ret advapi32.RegOpenKeyExA() retval=00000002 ret=004aacec
  1407. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1408. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1409. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1410. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1411. 002e:Call KERNEL32.GetVersionExA(0033f924) ret=004ac5cd
  1412. 002e:Ret KERNEL32.GetVersionExA() retval=00000001 ret=004ac5cd
  1413. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1414. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1415. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1416. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1417. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1418. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1419. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1420. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1421. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1422. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1423. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1424. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1425. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1426. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1427. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1428. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1429. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1430. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1431. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1432. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1433. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1434. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1435. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1436. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1437. 002e:Call advapi32.RegOpenKeyExA(80000002,005dc270 "SOFTWARE\\FLEXlm License Manager",00000000,00000001,0033f9ec) ret=004aacec
  1438. 002e:Ret advapi32.RegOpenKeyExA() retval=00000000 ret=004aacec
  1439. 002e:Call KERNEL32.MultiByteToWideChar(0000fde9,00000000,0055d244 "LM_UTIL_CASE_SENSITIVE",ffffffff,00000000,00000000) ret=004a589e
  1440. 002e:Ret KERNEL32.MultiByteToWideChar() retval=00000017 ret=004a589e
  1441. 002e:Call KERNEL32.MultiByteToWideChar(0000fde9,00000000,0055d244 "LM_UTIL_CASE_SENSITIVE",ffffffff,005dc270,00000018) ret=004a589e
  1442. 002e:Ret KERNEL32.MultiByteToWideChar() retval=00000017 ret=004a589e
  1443. 002e:Call advapi32.RegQueryValueExW(00000034,005dc270 L"LM_UTIL_CASE_SENSITIVE",00000000,0033f9d8,00000000,0033f988) ret=004a6549
  1444. 002e:Ret advapi32.RegQueryValueExW() retval=00000002 ret=004a6549
  1445. 002e:Call advapi32.RegCloseKey(00000034) ret=004aad68
  1446. 002e:Ret advapi32.RegCloseKey() retval=00000000 ret=004aad68
  1447. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1448. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1449. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1450. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1451. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1452. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1453. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1454. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1455. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1456. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1457. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1458. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1459. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1460. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1461. 002e:Call KERNEL32.GetVersionExA(0033f934) ret=004ac5cd
  1462. 002e:Ret KERNEL32.GetVersionExA() retval=00000001 ret=004ac5cd
  1463. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1464. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1465. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1466. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1467. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1468. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1469. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1470. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1471. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1472. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1473. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1474. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1475. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1476. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1477. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1478. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1479. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1480. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1481. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1482. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1483. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1484. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1485. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1486. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1487. 002e:Call advapi32.RegOpenKeyExA(80000002,005dc270 "SOFTWARE\\FLEXlm License Manager",00000000,00000001,0033f9fc) ret=004aacec
  1488. 002e:Ret advapi32.RegOpenKeyExA() retval=00000000 ret=004aacec
  1489. 002e:Call KERNEL32.MultiByteToWideChar(0000fde9,00000000,00556114 "LM_LICENSE_FILE",ffffffff,00000000,00000000) ret=004a589e
  1490. 002e:Ret KERNEL32.MultiByteToWideChar() retval=00000010 ret=004a589e
  1491. 002e:Call KERNEL32.MultiByteToWideChar(0000fde9,00000000,00556114 "LM_LICENSE_FILE",ffffffff,005dc270,00000011) ret=004a589e
  1492. 002e:Ret KERNEL32.MultiByteToWideChar() retval=00000010 ret=004a589e
  1493. 002e:Call advapi32.RegQueryValueExW(00000034,005dc270 L"LM_LICENSE_FILE",00000000,0033f9e8,00000000,0033f998) ret=004a6549
  1494. 002e:Ret advapi32.RegQueryValueExW() retval=00000002 ret=004a6549
  1495. 002e:Call advapi32.RegCloseKey(00000034) ret=004aad68
  1496. 002e:Ret advapi32.RegCloseKey() retval=00000000 ret=004aad68
  1497. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1498. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1499. 002e:Call KERNEL32.GetSystemTimeAsFileTime(0033f0a0) ret=00488187
  1500. 002e:Ret KERNEL32.GetSystemTimeAsFileTime() retval=01cc9572 ret=00488187
  1501. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1502. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1503. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1504. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1505. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1506. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1507. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1508. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1509. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1510. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1511. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1512. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1513. 002e:Call KERNEL32.GetVersionExA(0033ef8c) ret=004ac5cd
  1514. 002e:Ret KERNEL32.GetVersionExA() retval=00000001 ret=004ac5cd
  1515. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1516. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1517. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1518. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1519. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1520. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1521. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1522. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1523. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1524. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1525. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1526. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1527. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1528. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1529. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1530. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1531. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1532. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1533. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1534. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1535. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1536. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1537. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1538. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1539. 002e:Call advapi32.RegOpenKeyExA(80000002,005dc270 "SOFTWARE\\FLEXlm License Manager",00000000,00000001,0033f054) ret=004aacec
  1540. 002e:Ret advapi32.RegOpenKeyExA() retval=00000000 ret=004aacec
  1541. 002e:Call KERNEL32.MultiByteToWideChar(0000fde9,00000000,005638a8 "LM_DEBUG_HOSTID",ffffffff,00000000,00000000) ret=004a589e
  1542. 002e:Ret KERNEL32.MultiByteToWideChar() retval=00000010 ret=004a589e
  1543. 002e:Call KERNEL32.MultiByteToWideChar(0000fde9,00000000,005638a8 "LM_DEBUG_HOSTID",ffffffff,005dc270,00000011) ret=004a589e
  1544. 002e:Ret KERNEL32.MultiByteToWideChar() retval=00000010 ret=004a589e
  1545. 002e:Call advapi32.RegQueryValueExW(00000034,005dc270 L"LM_DEBUG_HOSTID",00000000,0033f040,00000000,0033eff0) ret=004a6549
  1546. 002e:Ret advapi32.RegQueryValueExW() retval=00000002 ret=004a6549
  1547. 002e:Call advapi32.RegCloseKey(00000034) ret=004aad68
  1548. 002e:Ret advapi32.RegCloseKey() retval=00000000 ret=004aad68
  1549. 002e:Call KERNEL32.GetVersion() ret=0051df1d
  1550. 002e:Ret KERNEL32.GetVersion() retval=0a280105 ret=0051df1d
  1551. 002e:Call KERNEL32.GetSystemTimeAsFileTime(0033f040) ret=00488187
  1552. 002e:Ret KERNEL32.GetSystemTimeAsFileTime() retval=01cc9572 ret=00488187
  1553. 002e:Call KERNEL32.GetVersion() ret=00542c34
  1554. 002e:Ret KERNEL32.GetVersion() retval=0a280105 ret=00542c34
  1555. 002e:Call KERNEL32.GetCurrentProcessId() ret=00542ab6
  1556. 002e:Ret KERNEL32.GetCurrentProcessId() retval=0000002d ret=00542ab6
  1557. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1558. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1559. 002e:Call KERNEL32.CreateMutexA(00000000,00000001,0033ee68 "IPHelperMutex_45") ret=00542ae1
  1560. 002e:Ret KERNEL32.CreateMutexA() retval=00000034 ret=00542ae1
  1561. 002e:Call KERNEL32.GetLastError() ret=00542b02
  1562. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=00542b02
  1563. 002e:Call KERNEL32.LoadLibraryA(0056bd24 "iphlpapi.dll") ret=00542b2c
  1564. 002e:Ret KERNEL32.LoadLibraryA() retval=401d0000 ret=00542b2c
  1565. 002e:Call KERNEL32.GetProcAddress(401d0000,0056bd34 "GetNetworkParams") ret=00542b58
  1566. 002e:Ret KERNEL32.GetProcAddress() retval=401dee84 ret=00542b58
  1567. 002e:Call KERNEL32.GetProcAddress(401d0000,0056bd48 "GetAdaptersInfo") ret=00542b78
  1568. 002e:Ret KERNEL32.GetProcAddress() retval=401ded4c ret=00542b78
  1569. 002e:Call KERNEL32.ReleaseMutex(00000034) ret=00542b94
  1570. 002e:Ret KERNEL32.ReleaseMutex() retval=00000001 ret=00542b94
  1571. 002e:Call KERNEL32.CloseHandle(00000034) ret=00542ba1
  1572. 002e:Ret KERNEL32.CloseHandle() retval=00000001 ret=00542ba1
  1573. 002e:Call iphlpapi.GetNetworkParams(00000000,0033ee48) ret=005427a2
  1574. 002e:Ret iphlpapi.GetNetworkParams() retval=0000006f ret=005427a2
  1575. 002e:Call iphlpapi.GetNetworkParams(005e33e8,0033ee48) ret=0054280c
  1576. 002e:Call KERNEL32.GetComputerNameExA(00000001,005e33e8,0033ed3c) ret=401e3166
  1577. 002e:Ret KERNEL32.GetComputerNameExA() retval=00000001 ret=401e3166
  1578. 002e:Call KERNEL32.GetComputerNameExA(00000002,005e346c,0033ed3c) ret=401e318a
  1579. 002e:Ret KERNEL32.GetComputerNameExA() retval=00000001 ret=401e318a
  1580. 002e:Call advapi32.RegOpenKeyExA(80000002,401e8214 "SYSTEM\\CurrentControlSet\\Services\\VxD\\MSTCP",00000000,00020019,0033ed34) ret=401e31e0
  1581. 002e:Ret advapi32.RegOpenKeyExA() retval=00000000 ret=401e31e0
  1582. 002e:Call advapi32.RegQueryValueExA(00000034,401e8273 "ScopeID",00000000,00000000,005e3520,0033ed30) ret=401e3255
  1583. 002e:Ret advapi32.RegQueryValueExA() retval=00000002 ret=401e3255
  1584. 002e:Call advapi32.RegCloseKey(00000034) ret=401e3263
  1585. 002e:Ret advapi32.RegCloseKey() retval=00000000 ret=401e3263
  1586. 002e:Ret iphlpapi.GetNetworkParams() retval=00000000 ret=0054280c
  1587. 002e:Call iphlpapi.GetAdaptersInfo(00000000,0033ef54) ret=00542859
  1588. 002e:Ret iphlpapi.GetAdaptersInfo() retval=0000006f ret=00542859
  1589. 002e:Call iphlpapi.GetAdaptersInfo(005e3638,0033ef54) ret=005428b4
  1590. 002e:Call advapi32.RegOpenKeyA(80000001,401e82c4 "Software\\Wine\\Network",0033ed10) ret=401e36dd
  1591. 002e:Ret advapi32.RegOpenKeyA() retval=00000002 ret=401e36dd
  1592. 002e:Ret iphlpapi.GetAdaptersInfo() retval=00000000 ret=005428b4
  1593. 002e:Call advapi32.RegOpenKeyExA(80000002,0056bdd0 "SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}",00000000,00020019,0033ee10) ret=00543378
  1594. 002e:Ret advapi32.RegOpenKeyExA() retval=00000000 ret=00543378
  1595. 002e:Call advapi32.RegQueryInfoKeyA(00000034,00000000,00000000,00000000,0033ee0c,0033edf4,00000000,00000000,00000000,00000000,00000000,00000000) ret=005433a9
  1596. 002e:Ret advapi32.RegQueryInfoKeyA() retval=00000000 ret=005433a9
  1597. 002e:Call advapi32.RegEnumKeyExA(00000034,00000000,005dc270,0033ee14,00000000,00000000,00000000,0033ee00) ret=00543421
  1598. 002e:Ret advapi32.RegEnumKeyExA() retval=00000000 ret=00543421
  1599. 002e:Call advapi32.RegOpenKeyExA(00000034,005dc270 "0000",00000000,00020019,0033edf0) ret=00543450
  1600. 002e:Ret advapi32.RegOpenKeyExA() retval=00000000 ret=00543450
  1601. 002e:Call advapi32.RegQueryValueExA(0000003c,0056be20 "NetCfgInstanceId",00000000,0033ede8,0033ecd8,0033edfc) ret=0054347d
  1602. 002e:Ret advapi32.RegQueryValueExA() retval=00000000 ret=0054347d
  1603. 002e:Call advapi32.RegCloseKey(0000003c) ret=00543529
  1604. 002e:Ret advapi32.RegCloseKey() retval=00000000 ret=00543529
  1605. 002e:Call advapi32.RegEnumKeyExA(00000034,00000001,005dc270,0033ee14,00000000,00000000,00000000,0033ee00) ret=00543421
  1606. 002e:Ret advapi32.RegEnumKeyExA() retval=00000000 ret=00543421
  1607. 002e:Call advapi32.RegOpenKeyExA(00000034,005dc270 "0001",00000000,00020019,0033edf0) ret=00543450
  1608. 002e:Ret advapi32.RegOpenKeyExA() retval=00000000 ret=00543450
  1609. 002e:Call advapi32.RegQueryValueExA(0000003c,0056be20 "NetCfgInstanceId",00000000,0033ede8,0033ecd8,0033edfc) ret=0054347d
  1610. 002e:Ret advapi32.RegQueryValueExA() retval=00000000 ret=0054347d
  1611. 002e:Call advapi32.RegCloseKey(0000003c) ret=00543529
  1612. 002e:Ret advapi32.RegCloseKey() retval=00000000 ret=00543529
  1613. 002e:Call advapi32.RegEnumKeyExA(00000034,00000002,005dc270,0033ee14,00000000,00000000,00000000,0033ee00) ret=00543421
  1614. 002e:Ret advapi32.RegEnumKeyExA() retval=00000000 ret=00543421
  1615. 002e:Call advapi32.RegOpenKeyExA(00000034,005dc270 "0002",00000000,00020019,0033edf0) ret=00543450
  1616. 002e:Ret advapi32.RegOpenKeyExA() retval=00000000 ret=00543450
  1617. 002e:Call advapi32.RegQueryValueExA(0000003c,0056be20 "NetCfgInstanceId",00000000,0033ede8,0033ecd8,0033edfc) ret=0054347d
  1618. 002e:Ret advapi32.RegQueryValueExA() retval=00000000 ret=0054347d
  1619. 002e:Call advapi32.RegCloseKey(0000003c) ret=00543529
  1620. 002e:Ret advapi32.RegCloseKey() retval=00000000 ret=00543529
  1621. 002e:Call advapi32.RegCloseKey(00000034) ret=0054354a
  1622. 002e:Ret advapi32.RegCloseKey() retval=00000000 ret=0054354a
  1623. 002e:Call advapi32.RegOpenKeyExA(80000002,0056bdd0 "SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}",00000000,00020019,0033ee10) ret=00543378
  1624. 002e:Ret advapi32.RegOpenKeyExA() retval=00000000 ret=00543378
  1625. 002e:Call advapi32.RegQueryInfoKeyA(00000034,00000000,00000000,00000000,0033ee0c,0033edf4,00000000,00000000,00000000,00000000,00000000,00000000) ret=005433a9
  1626. 002e:Ret advapi32.RegQueryInfoKeyA() retval=00000000 ret=005433a9
  1627. 002e:Call advapi32.RegEnumKeyExA(00000034,00000000,005dc270,0033ee14,00000000,00000000,00000000,0033ee00) ret=00543421
  1628. 002e:Ret advapi32.RegEnumKeyExA() retval=00000000 ret=00543421
  1629. 002e:Call advapi32.RegOpenKeyExA(00000034,005dc270 "0000",00000000,00020019,0033edf0) ret=00543450
  1630. 002e:Ret advapi32.RegOpenKeyExA() retval=00000000 ret=00543450
  1631. 002e:Call advapi32.RegQueryValueExA(0000003c,0056be20 "NetCfgInstanceId",00000000,0033ede8,0033ecd8,0033edfc) ret=0054347d
  1632. 002e:Ret advapi32.RegQueryValueExA() retval=00000000 ret=0054347d
  1633. 002e:Call advapi32.RegCloseKey(0000003c) ret=00543529
  1634. 002e:Ret advapi32.RegCloseKey() retval=00000000 ret=00543529
  1635. 002e:Call advapi32.RegEnumKeyExA(00000034,00000001,005dc270,0033ee14,00000000,00000000,00000000,0033ee00) ret=00543421
  1636. 002e:Ret advapi32.RegEnumKeyExA() retval=00000000 ret=00543421
  1637. 002e:Call advapi32.RegOpenKeyExA(00000034,005dc270 "0001",00000000,00020019,0033edf0) ret=00543450
  1638. 002e:Ret advapi32.RegOpenKeyExA() retval=00000000 ret=00543450
  1639. 002e:Call advapi32.RegQueryValueExA(0000003c,0056be20 "NetCfgInstanceId",00000000,0033ede8,0033ecd8,0033edfc) ret=0054347d
  1640. 002e:Ret advapi32.RegQueryValueExA() retval=00000000 ret=0054347d
  1641. 002e:Call advapi32.RegCloseKey(0000003c) ret=00543529
  1642. 002e:Ret advapi32.RegCloseKey() retval=00000000 ret=00543529
  1643. 002e:Call advapi32.RegEnumKeyExA(00000034,00000002,005dc270,0033ee14,00000000,00000000,00000000,0033ee00) ret=00543421
  1644. 002e:Ret advapi32.RegEnumKeyExA() retval=00000000 ret=00543421
  1645. 002e:Call advapi32.RegOpenKeyExA(00000034,005dc270 "0002",00000000,00020019,0033edf0) ret=00543450
  1646. 002e:Ret advapi32.RegOpenKeyExA() retval=00000000 ret=00543450
  1647. 002e:Call advapi32.RegQueryValueExA(0000003c,0056be20 "NetCfgInstanceId",00000000,0033ede8,0033ecd8,0033edfc) ret=0054347d
  1648. 002e:Ret advapi32.RegQueryValueExA() retval=00000000 ret=0054347d
  1649. 002e:Call advapi32.RegCloseKey(0000003c) ret=00543529
  1650. 002e:Ret advapi32.RegCloseKey() retval=00000000 ret=00543529
  1651. 002e:Call advapi32.RegCloseKey(00000034) ret=0054354a
  1652. 002e:Ret advapi32.RegCloseKey() retval=00000000 ret=0054354a
  1653. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1654. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1655. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1656. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1657. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1658. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1659. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1660. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1661. 002e:Call KERNEL32.GetVersionExA(0033ef2c) ret=004ac5cd
  1662. 002e:Ret KERNEL32.GetVersionExA() retval=00000001 ret=004ac5cd
  1663. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1664. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1665. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1666. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1667. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1668. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1669. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1670. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1671. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1672. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1673. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1674. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1675. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1676. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1677. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1678. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1679. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1680. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1681. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1682. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1683. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1684. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1685. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1686. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1687. 002e:Call advapi32.RegOpenKeyExA(80000002,005dc270 "SOFTWARE\\FLEXlm License Manager",00000000,00000001,0033eff4) ret=004aacec
  1688. 002e:Ret advapi32.RegOpenKeyExA() retval=00000000 ret=004aacec
  1689. 002e:Call KERNEL32.MultiByteToWideChar(0000fde9,00000000,005690b8 "LM_NO_NETBIOS",ffffffff,00000000,00000000) ret=004a589e
  1690. 002e:Ret KERNEL32.MultiByteToWideChar() retval=0000000e ret=004a589e
  1691. 002e:Call KERNEL32.MultiByteToWideChar(0000fde9,00000000,005690b8 "LM_NO_NETBIOS",ffffffff,005dc270,0000000f) ret=004a589e
  1692. 002e:Ret KERNEL32.MultiByteToWideChar() retval=0000000e ret=004a589e
  1693. 002e:Call advapi32.RegQueryValueExW(00000034,005dc270 L"LM_NO_NETBIOS",00000000,0033efe0,00000000,0033ef90) ret=004a6549
  1694. 002e:Ret advapi32.RegQueryValueExW() retval=00000002 ret=004a6549
  1695. 002e:Call advapi32.RegCloseKey(00000034) ret=004aad68
  1696. 002e:Ret advapi32.RegCloseKey() retval=00000000 ret=004aad68
  1697. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1698. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1699. 002e:Call KERNEL32.MultiByteToWideChar(0000fde9,00000000,0057d830 "ffffffff",ffffffff,00000000,00000000) ret=004a589e
  1700. 002e:Ret KERNEL32.MultiByteToWideChar() retval=00000009 ret=004a589e
  1701. 002e:Call KERNEL32.MultiByteToWideChar(0000fde9,00000000,0057d830 "ffffffff",ffffffff,005dc270,0000000a) ret=004a589e
  1702. 002e:Ret KERNEL32.MultiByteToWideChar() retval=00000009 ret=004a589e
  1703. 002e:Call KERNEL32.WideCharToMultiByte(00000000,00000000,005dc270 L"ffffffff",ffffffff,00000000,00000000,00000000,00000000) ret=004a58d9
  1704. 002e:Ret KERNEL32.WideCharToMultiByte() retval=00000009 ret=004a58d9
  1705. 002e:Call KERNEL32.WideCharToMultiByte(00000000,00000000,005dc270 L"ffffffff",ffffffff,005e33e8,0000000a,00000000,00000000) ret=004a58d9
  1706. 002e:Ret KERNEL32.WideCharToMultiByte() retval=00000009 ret=004a58d9
  1707. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1708. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1709. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1710. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1711. 002e:Call KERNEL32.GetLastError() ret=004022ad
  1712. 002e:Ret KERNEL32.GetLastError() retval=00000000 ret=004022ad
  1713. 002e:Call ntdll.RtlDecodePointer(e132ec18) ret=00402130
  1714. 002e:Ret ntdll.RtlDecodePointer() retval=005dba60 ret=00402130
  1715. 002e:Call ntdll.RtlDecodePointer(e132ec1c) ret=00402130
  1716. 002e:Ret ntdll.RtlDecodePointer() retval=005dba64 ret=00402130
  1717. 002e:Call ntdll.RtlEncodePointer(00000000) ret=004020b9
  1718. 002e:Ret ntdll.RtlEncodePointer() retval=e16f5678 ret=004020b9
  1719. 002e:Call ntdll.RtlDecodePointer(e12f49bd) ret=00402130
  1720. 002e:Ret ntdll.RtlDecodePointer() retval=00401fc5 ret=00402130
  1721. 002e:Call KERNEL32.WriteFile(00000004,0033f7f8,00000081,0033f7d8,00000000) ret=0048c6b6
  1722. 002e:Ret KERNEL32.WriteFile() retval=00000001 ret=0048c6b6
  1723. 002e:Call KERNEL32.GetModuleHandleA(0054a3dc "mscoree.dll") ret=0040129f
  1724. 002e:Ret KERNEL32.GetModuleHandleA() retval=00000000 ret=0040129f
  1725. 002e:Call KERNEL32.ExitProcess(00000000) ret=004012ce
  1726. 002e:Call PE DLL (proc=0x41796f60,module=0x416e0000 L"oleaut32.dll",reason=PROCESS_DETACH,res=0x1)
  1727. 002e:Ret PE DLL (proc=0x41796f60,module=0x416e0000 L"oleaut32.dll",reason=PROCESS_DETACH,res=0x1) retval=1
  1728. 002e:Call PE DLL (proc=0x412f14b0,module=0x412c0000 L"comdlg32.dll",reason=PROCESS_DETACH,res=0x1)
  1729. 002e:Ret PE DLL (proc=0x412f14b0,module=0x412c0000 L"comdlg32.dll",reason=PROCESS_DETACH,res=0x1) retval=1
  1730. 002e:Call PE DLL (proc=0x416bf6f0,module=0x416a0000 L"winspool.drv",reason=PROCESS_DETACH,res=0x1)
  1731. 002e:Call KERNEL32.FreeLibrary(00000000) ret=416bf511
  1732. 002e:Ret KERNEL32.FreeLibrary() retval=00000000 ret=416bf511
  1733. 002e:Ret PE DLL (proc=0x416bf6f0,module=0x416a0000 L"winspool.drv",reason=PROCESS_DETACH,res=0x1) retval=1
  1734. 002e:Call PE DLL (proc=0x4145b3c0,module=0x413d0000 L"shell32.dll",reason=PROCESS_DETACH,res=0x1)
  1735. 002e:Call comctl32.DPA_DestroyCallback(00158a18,413fc2d0,00000000) ret=413fb817
  1736. 002e:Call KERNEL32.GetProcAddress(41800000,4147b0ba "CoTaskMemFree") ret=4145b34c
  1737. 002e:Ret KERNEL32.GetProcAddress() retval=41801df0 ret=4145b34c
  1738. 002e:Call ole32.CoTaskMemFree(0015ff70) ret=414171d0
  1739. 002e:Ret ole32.CoTaskMemFree() retval=00000001 ret=414171d0
  1740. 002e:Call ole32.CoTaskMemFree(0015ff90) ret=414171d0
  1741. 002e:Ret ole32.CoTaskMemFree() retval=00000001 ret=414171d0
  1742. 002e:Ret comctl32.DPA_DestroyCallback() retval=00000001 ret=413fb817
  1743. 002e:Call comctl32.ImageList_Destroy(00158c30) ret=413fb834
  1744. 002e:Call gdi32.DeleteObject(0000048c) ret=411cfada
  1745. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411cfada
  1746. 002e:Call gdi32.DeleteObject(00000494) ret=411cfaec
  1747. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411cfaec
  1748. 002e:Call gdi32.DeleteDC(00000250) ret=411cfafe
  1749. 002e:Ret gdi32.DeleteDC() retval=00000001 ret=411cfafe
  1750. 002e:Call gdi32.DeleteDC(0000025c) ret=411cfb10
  1751. 002e:Ret gdi32.DeleteDC() retval=00000001 ret=411cfb10
  1752. 002e:Call gdi32.DeleteObject(0000027c) ret=411cfb22
  1753. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411cfb22
  1754. 002e:Call gdi32.DeleteObject(00000288) ret=411cfb34
  1755. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411cfb34
  1756. 002e:Ret comctl32.ImageList_Destroy() retval=00000001 ret=413fb834
  1757. 002e:Call comctl32.ImageList_Destroy(0015a938) ret=413fb84d
  1758. 002e:Call gdi32.DeleteObject(0000051c) ret=411cfada
  1759. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411cfada
  1760. 002e:Call gdi32.DeleteObject(00000524) ret=411cfaec
  1761. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411cfaec
  1762. 002e:Call gdi32.DeleteDC(0000028c) ret=411cfafe
  1763. 002e:Ret gdi32.DeleteDC() retval=00000001 ret=411cfafe
  1764. 002e:Call gdi32.DeleteDC(00000298) ret=411cfb10
  1765. 002e:Ret gdi32.DeleteDC() retval=00000001 ret=411cfb10
  1766. 002e:Call gdi32.DeleteObject(000002b8) ret=411cfb22
  1767. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411cfb22
  1768. 002e:Call gdi32.DeleteObject(000002c4) ret=411cfb34
  1769. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411cfb34
  1770. 002e:Ret comctl32.ImageList_Destroy() retval=00000001 ret=413fb84d
  1771. 002e:Call ntdll.RtlDeleteCriticalSection(415d33d4) ret=413fb869
  1772. 002e:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=413fb869
  1773. 002e:Call ntdll.RtlDeleteCriticalSection(415d3170) ret=413e62a8
  1774. 002e:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=413e62a8
  1775. 002e:Ret PE DLL (proc=0x4145b3c0,module=0x413d0000 L"shell32.dll",reason=PROCESS_DETACH,res=0x1) retval=1
  1776. 002e:Call PE DLL (proc=0x418cae50,module=0x41800000 L"ole32.dll",reason=PROCESS_DETACH,res=0x1)
  1777. 002e:Call user32.UnregisterClassW(418d8860 L"OleMainThreadWndClass 0x######## ",41800000) ret=418143fb
  1778. 002e:Ret user32.UnregisterClassW() retval=00000001 ret=418143fb
  1779. 002e:Ret PE DLL (proc=0x418cae50,module=0x41800000 L"ole32.dll",reason=PROCESS_DETACH,res=0x1) retval=1
  1780. 002e:Call PE DLL (proc=0x419847e0,module=0x41940000 L"rpcrt4.dll",reason=PROCESS_DETACH,res=0x1)
  1781. 002e:Ret PE DLL (proc=0x419847e0,module=0x41940000 L"rpcrt4.dll",reason=PROCESS_DETACH,res=0x1) retval=1
  1782. 002e:Call PE DLL (proc=0x41659e40,module=0x41620000 L"shlwapi.dll",reason=PROCESS_DETACH,res=0x1)
  1783. 002e:Call KERNEL32.TlsFree(00000002) ret=4164b28a
  1784. 002e:Ret KERNEL32.TlsFree() retval=00000001 ret=4164b28a
  1785. 002e:Ret PE DLL (proc=0x41659e40,module=0x41620000 L"shlwapi.dll",reason=PROCESS_DETACH,res=0x1) retval=1
  1786. 002e:Call PE DLL (proc=0x41248a50,module=0x411a0000 L"comctl32.dll",reason=PROCESS_DETACH,res=0x1)
  1787. 002e:Call user32.UnregisterClassW(0033fac6 L"SysAnimate32",00000000) ret=411af0d7
  1788. 002e:Ret user32.UnregisterClassW() retval=00000001 ret=411af0d7
  1789. 002e:Call user32.UnregisterClassW(0033fac6 L"ComboBoxEx32",00000000) ret=411b1cf7
  1790. 002e:Ret user32.UnregisterClassW() retval=00000001 ret=411b1cf7
  1791. 002e:Call user32.UnregisterClassW(0033fabc L"SysDateTimePick32",00000000) ret=411bcc55
  1792. 002e:Ret user32.UnregisterClassW() retval=00000001 ret=411bcc55
  1793. 002e:Call user32.UnregisterClassW(0033fac2 L"flatsb_class32",00000000) ret=411c3f93
  1794. 002e:Ret user32.UnregisterClassW() retval=00000001 ret=411c3f93
  1795. 002e:Call user32.UnregisterClassW(0033fac8 L"SysHeader32",00000000) ret=411c4771
  1796. 002e:Ret user32.UnregisterClassW() retval=00000001 ret=411c4771
  1797. 002e:Call user32.UnregisterClassW(0033fac0 L"msctls_hotkey32",00000000) ret=411c9119
  1798. 002e:Ret user32.UnregisterClassW() retval=00000001 ret=411c9119
  1799. 002e:Call user32.UnregisterClassW(0033fac2 L"SysIPAddress32",00000000) ret=411d2c43
  1800. 002e:Ret user32.UnregisterClassW() retval=00000001 ret=411d2c43
  1801. 002e:Call user32.UnregisterClassW(0033fac4 L"SysListView32",00000000) ret=411d482d
  1802. 002e:Ret user32.UnregisterClassW() retval=00000001 ret=411d482d
  1803. 002e:Call user32.UnregisterClassW(0033fac4 L"SysMonthCal32",00000000) ret=411f08ed
  1804. 002e:Ret user32.UnregisterClassW() retval=00000001 ret=411f08ed
  1805. 002e:Call user32.UnregisterClassW(0033fac4 L"NativeFontCtl",00000000) ret=411f923d
  1806. 002e:Ret user32.UnregisterClassW() retval=00000001 ret=411f923d
  1807. 002e:Call user32.UnregisterClassW(0033face L"SysPager",00000000) ret=411f95bf
  1808. 002e:Ret user32.UnregisterClassW() retval=00000001 ret=411f95bf
  1809. 002e:Call user32.UnregisterClassW(0033fabc L"msctls_progress32",00000000) ret=411fc675
  1810. 002e:Ret user32.UnregisterClassW() retval=00000001 ret=411fc675
  1811. 002e:Call user32.UnregisterClassW(0033fac4 L"ReBarWindow32",00000000) ret=41205cdd
  1812. 002e:Ret user32.UnregisterClassW() retval=00000001 ret=41205cdd
  1813. 002e:Call user32.UnregisterClassW(0033faba L"msctls_statusbar32",00000000) ret=4120f3cb
  1814. 002e:Ret user32.UnregisterClassW() retval=00000001 ret=4120f3cb
  1815. 002e:Call user32.UnregisterClassW(0033fad0 L"SysLink",00000000) ret=412148b9
  1816. 002e:Ret user32.UnregisterClassW() retval=00000001 ret=412148b9
  1817. 002e:Call user32.UnregisterClassW(0033fac0 L"SysTabControl32",00000000) ret=412174c9
  1818. 002e:Ret user32.UnregisterClassW() retval=00000001 ret=412174c9
  1819. 002e:Call user32.UnregisterClassW(0033fac0 L"ToolbarWindow32",00000000) ret=41221bc9
  1820. 002e:Ret user32.UnregisterClassW() retval=00000001 ret=41221bc9
  1821. 002e:Call user32.DestroyIcon(00260082) ret=4123113b
  1822. 002e:Ret user32.DestroyIcon() retval=00000001 ret=4123113b
  1823. 002e:Call user32.DestroyIcon(000e0026) ret=4123113b
  1824. 002e:Ret user32.DestroyIcon() retval=00000001 ret=4123113b
  1825. 002e:Call user32.DestroyIcon(000600ae) ret=4123113b
  1826. 002e:Ret user32.DestroyIcon() retval=00000001 ret=4123113b
  1827. 002e:Call user32.UnregisterClassW(0033faae L"tooltips_class32",00000000) ret=412311be
  1828. 002e:Ret user32.UnregisterClassW() retval=00000001 ret=412311be
  1829. 002e:Call user32.UnregisterClassW(0033fabc L"msctls_trackbar32",00000000) ret=412362c5
  1830. 002e:Ret user32.UnregisterClassW() retval=00000001 ret=412362c5
  1831. 002e:Call user32.UnregisterClassW(0033fac4 L"SysTreeView32",00000000) ret=4123a63d
  1832. 002e:Ret user32.UnregisterClassW() retval=00000001 ret=4123a63d
  1833. 002e:Call user32.UnregisterClassW(0033fac0 L"msctls_updown32",00000000) ret=41246389
  1834. 002e:Ret user32.UnregisterClassW() retval=00000001 ret=41246389
  1835. 002e:Call gdi32.DeleteObject(000001dc) ret=411bc7e4
  1836. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411bc7e4
  1837. 002e:Call gdi32.DeleteObject(000001d4) ret=411bc7ff
  1838. 002e:Ret gdi32.DeleteObject() retval=00000001 ret=411bc7ff
  1839. 002e:Call KERNEL32.GlobalDeleteAtom(0000c016) ret=411bc81b
  1840. 002e:Ret KERNEL32.GlobalDeleteAtom() retval=00000000 ret=411bc81b
  1841. 002e:Ret PE DLL (proc=0x41248a50,module=0x411a0000 L"comctl32.dll",reason=PROCESS_DETACH,res=0x1) retval=1
  1842. 002e:Call PE DLL (proc=0x428cb5a0,module=0x428b0000 L"uxtheme.dll",reason=PROCESS_DETACH,res=0x1)
  1843. 002e:Ret PE DLL (proc=0x428cb5a0,module=0x428b0000 L"uxtheme.dll",reason=PROCESS_DETACH,res=0x1) retval=1
  1844. 002e:Call PE DLL (proc=0x4118a170,module=0x41170000 L"netapi32.dll",reason=PROCESS_DETACH,res=0x1)
  1845. 002e:Call ntdll.RtlDeleteCriticalSection(41190b40) ret=41187010
  1846. 002e:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=41187010
  1847. 002e:Ret PE DLL (proc=0x4118a170,module=0x41170000 L"netapi32.dll",reason=PROCESS_DETACH,res=0x1) retval=1
  1848. 002e:Call PE DLL (proc=0x410ac360,module=0x41010000 L"user32.dll",reason=PROCESS_DETACH,res=0x1)
  1849. 002e:Ret PE DLL (proc=0x410ac360,module=0x41010000 L"user32.dll",reason=PROCESS_DETACH,res=0x1) retval=1
  1850. 002e:Call PE DLL (proc=0x41bfded0,module=0x41b90000 L"winex11.drv",reason=PROCESS_DETACH,res=0x1)
  1851. 002e:Ret PE DLL (proc=0x41bfded0,module=0x41b90000 L"winex11.drv",reason=PROCESS_DETACH,res=0x1) retval=1
  1852. 002e:Call PE DLL (proc=0x41d75be0,module=0x41d60000 L"imm32.dll",reason=PROCESS_DETACH,res=0x1)
  1853. 002e:Call KERNEL32.TlsFree(00000000) ret=41d70a4a
  1854. 002e:Ret KERNEL32.TlsFree() retval=00000001 ret=41d70a4a
  1855. 002e:Ret PE DLL (proc=0x41d75be0,module=0x41d60000 L"imm32.dll",reason=PROCESS_DETACH,res=0x1) retval=1
  1856. 002e:Call PE DLL (proc=0x411667a0,module=0x41160000 L"version.dll",reason=PROCESS_DETACH,res=0x1)
  1857. 002e:Ret PE DLL (proc=0x411667a0,module=0x41160000 L"version.dll",reason=PROCESS_DETACH,res=0x1) retval=1
  1858. 002e:Call PE DLL (proc=0x407aaee0,module=0x40730000 L"gdi32.dll",reason=PROCESS_DETACH,res=0x1)
  1859. 002e:Ret PE DLL (proc=0x407aaee0,module=0x40730000 L"gdi32.dll",reason=PROCESS_DETACH,res=0x1) retval=1
  1860. 002e:Call PE DLL (proc=0x401c52a0,module=0x401c0000 L"wsock32.dll",reason=PROCESS_DETACH,res=0x1)
  1861. 002e:Ret PE DLL (proc=0x401c52a0,module=0x401c0000 L"wsock32.dll",reason=PROCESS_DETACH,res=0x1) retval=1
  1862. 002e:Call PE DLL (proc=0x401e72d0,module=0x401d0000 L"iphlpapi.dll",reason=PROCESS_DETACH,res=0x1)
  1863. 002e:Ret PE DLL (proc=0x401e72d0,module=0x401d0000 L"iphlpapi.dll",reason=PROCESS_DETACH,res=0x1) retval=1
  1864. 002e:Call PE DLL (proc=0x40702970,module=0x406c0000 L"advapi32.dll",reason=PROCESS_DETACH,res=0x1)
  1865. 002e:Ret PE DLL (proc=0x40702970,module=0x406c0000 L"advapi32.dll",reason=PROCESS_DETACH,res=0x1) retval=1
  1866. 002e:Call PE DLL (proc=0x406ad5a0,module=0x40690000 L"ws2_32.dll",reason=PROCESS_DETACH,res=0x1)
  1867. 002e:Ret PE DLL (proc=0x406ad5a0,module=0x40690000 L"ws2_32.dll",reason=PROCESS_DETACH,res=0x1) retval=1
  1868. 002e:Call PE DLL (proc=0x7b8725f0,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_DETACH,res=0x1)
  1869. 002e:Ret PE DLL (proc=0x7b8725f0,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_DETACH,res=0x1) retval=1
  1870. 002e:Call PE DLL (proc=0x7bc7b8c0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_DETACH,res=0x1)
  1871. 002e:Ret PE DLL (proc=0x7bc7b8c0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_DETACH,res=0x1) retval=1
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!